CVE-2026-20164: Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise
In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, and 9.3.2411.123, a low-privileged user that does not hold the "admin" or "power" Splunk roles could access the /splunkd/raw/servicesNS/-/-/configs/conf-passwords REST API endpoint, which exposes the hashed or plaintext password values that are stored in the passwords.conf configuration file due to improper access control. This vulnerability could allow for the unauthorized disclosure of sensitive credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20164?
CVE-2026-20164 is classified as a low-severity vulnerability.
How do I fix CVE-2026-20164?
To fix CVE-2026-20164, upgrade to Splunk Enterprise version 10.2.0 or higher, or use the recommended updates for Splunk Cloud Platform.
Which versions are affected by CVE-2026-20164?
CVE-2026-20164 affects Splunk Enterprise versions below 10.2.0 and Splunk Cloud Platform versions below 10.2.2510.5.
What type of vulnerability is CVE-2026-20164?
CVE-2026-20164 is a sensitive information disclosure vulnerability caused by improper access control.
Who can exploit CVE-2026-20164?
A low-privileged user who does not have the appropriate permissions can exploit CVE-2026-20164.