CVE-2026-20144: Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the the Splunk internal index could view the Security Assertion Markup Language (SAML) configurations for Attribute query requests (AQRs) or Authentication extensions in plain text within the conf.log file, depending on which feature is configured.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20144?
CVE-2026-20144 is rated as high severity due to its potential to allow unauthorized access to sensitive information within Splunk deployments.
How do I fix CVE-2026-20144?
To fix CVE-2026-20144, upgrade to the latest versions of Splunk Enterprise or Splunk Cloud Platform that are not affected by this vulnerability.
What versions are affected by CVE-2026-20144?
CVE-2026-20144 affects Splunk Enterprise versions prior to 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11 and Splunk Cloud Platform versions prior to 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120.
What potential impact does CVE-2026-20144 have?
The potential impact of CVE-2026-20144 includes unauthorized access to internal data within Splunk, potentially leading to data leaks.
Who is vulnerable to CVE-2026-20144?
A user of a Splunk Search Head Cluster deployment with a role that has access to the Splunk _internal index is vulnerable to CVE-2026-20144.