CVE-2026-20165: Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise
In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9.3.2411.124, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve sensitive information by inspecting the job's search log due to improper access control in the MongoClient logging channel.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20165?
CVE-2026-20165 is classified as having low severity due to the potential for sensitive information disclosure.
How do I fix CVE-2026-20165?
To fix CVE-2026-20165, upgrade to Splunk Enterprise version 10.2.1 or higher, or the appropriate Splunk Cloud Platform versions.
Who is affected by CVE-2026-20165?
CVE-2026-20165 affects users of Splunk Enterprise below version 10.2.1 and various versions of Splunk Cloud Platform.
What type of vulnerability is CVE-2026-20165?
CVE-2026-20165 is a vulnerability that allows sensitive information disclosure via the MongoClient logging channel.
Can a low-privileged user exploit CVE-2026-20165?
Yes, a low-privileged user can exploit CVE-2026-20165 to access sensitive information due to improper logging.