CVE-2026-20142: Sensitive Information Disclosure in "_internal" index in Splunk Enterprise
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk internal index could view the RSA accessKey value from the <u>Authentication.conf</u> file, in plain text.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20142?
CVE-2026-20142 is considered a medium severity vulnerability due to the exposure of sensitive authentication information.
How do I fix CVE-2026-20142?
To fix CVE-2026-20142, upgrade to Splunk Enterprise version 10.2.0 or later, 10.0.2 or later, 9.4.7 or later, 9.3.9 or later, or 9.2.11 or later.
Who is affected by CVE-2026-20142?
CVE-2026-20142 affects users of Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11 who have access to the Splunk _internal index.
What data is exposed in CVE-2026-20142?
CVE-2026-20142 allows unauthorized users to view the RSA accessKey value from the Authentication.conf configuration file.
What is the attack vector for CVE-2026-20142?
CVE-2026-20142 can be exploited by users with roles that allow access to the Splunk _internal index in affected versions.