CVE-2026-20252: Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could send server-side requests to arbitrary internal destinations through the Dashboard Studio PDF export feature.
The vulnerability exists because the trusted-domain validation uses a prefix match that can be bypassed with attacker-controlled subdomains (for example, docs.splunk.com.evil.com), and because the PDF export service follows HTTP redirects automatically without re-validating each redirect target against the allowlist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.4 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.7 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.12 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.3.13 - Upgrade
Upgrade
Splunk Cloud Platformto a version that resolves this vulnerability.Fixed in 10.4.2604.3 - Upgrade
Upgrade
Splunk Cloud Platformto a version that resolves this vulnerability.Fixed in 10.3.2512.12 - Upgrade
Upgrade
Splunk Cloud Platformto a version that resolves this vulnerability.Fixed in 10.2.2510.14 - Upgrade
Upgrade
Splunk Cloud Platformto a version that resolves this vulnerability.Fixed in 10.1.2507.22 - Upgrade
Upgrade
Splunk Cloud Platformto a version that resolves this vulnerability.Fixed in 9.3.2411.132 - Configuration
Restrict usage of the Dashboard Studio PDF export feature to the admin and power Splunk roles only, preventing low-privileged users from invoking the export functionality.
Dashboard Studio PDF export allowed_roles = admin, power - Configuration
If PDF export is not required, disable the Dashboard Studio PDF export feature to eliminate the attack surface used for SSRF.
Dashboard Studio PDF export feature_enabled = false - Compensating control
Apply network-level controls to prevent SSRF impact: block or restrict the Splunk server's (and any PDF-export service's) outbound access to internal IP ranges (e.g., RFC1918, localhost) and other sensitive internal destinations using firewall rules, ACLs, or egress filtering.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20252?
CVE-2026-20252 has a high severity rating of 7.6.
How do I fix CVE-2026-20252?
To fix CVE-2026-20252, upgrade to Splunk Enterprise versions 10.2.4, 10.0.7, 9.4.12, or 9.3.13, or Splunk Cloud Platform versions 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, or 9.3.2411.132.
What is the impact of CVE-2026-20252?
CVE-2026-20252 allows a low-privileged user to send server-side requests, potentially exposing sensitive data.
Who is affected by CVE-2026-20252?
CVE-2026-20252 affects users of Splunk Enterprise and Splunk Cloud Platform below the specified version thresholds.
What type of vulnerability is CVE-2026-20252?
CVE-2026-20252 is classified as a Server-Side Request Forgery (SSRF) vulnerability.