CVE-2026-20239: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. in Splunk Splunk Enterprise
CVE-2026-20239 is a vulnerability in Splunk Enterprise and certain versions of Splunk Cloud Platform where sensitive information such as session cookies and response bodies containing sensitive data can be accessed by users with roles that have access to the _internal index. This exposure occurs in Splunk Enterprise versions below 10.2.2 and 10.0.5, and in specified older versions of Splunk Cloud Platform. The vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation level has been confirmed in the provided data. There are no known exploits in the wild at this time.
AI Analysis
Technical Summary
This vulnerability allows users with access to the _internal index in affected versions of Splunk Enterprise and Splunk Cloud Platform to view sensitive data including session cookies and response bodies logged internally. The affected versions are below 10.2.2 and 10.0.5 for Splunk Enterprise, and below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13 for Splunk Cloud Platform. The CVSS 3.1 score of 7.5 indicates a high impact on confidentiality, integrity, and availability, requiring low privileges but with high attack complexity. The vulnerability is publicly known but no vendor advisory or patch information is provided in the input data.
Potential Impact
An attacker or unauthorized user with access to the _internal index can obtain sensitive information such as session cookies and response bodies, potentially leading to exposure of sensitive user data and guidance for further attacks. This compromises confidentiality and integrity of the system data and can affect availability due to the high CVSS impact metrics.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the _internal index to only trusted users and roles to minimize exposure. Monitor for updates from Splunk regarding patches or configuration changes that address this vulnerability.
CVE-2026-20239: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. in Splunk Splunk Enterprise
Description
CVE-2026-20239 is a vulnerability in Splunk Enterprise and certain versions of Splunk Cloud Platform where sensitive information such as session cookies and response bodies containing sensitive data can be accessed by users with roles that have access to the _internal index. This exposure occurs in Splunk Enterprise versions below 10.2.2 and 10.0.5, and in specified older versions of Splunk Cloud Platform. The vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation level has been confirmed in the provided data. There are no known exploits in the wild at this time.
CVSS v3.1
Score 7.5high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability allows users with access to the _internal index in affected versions of Splunk Enterprise and Splunk Cloud Platform to view sensitive data including session cookies and response bodies logged internally. The affected versions are below 10.2.2 and 10.0.5 for Splunk Enterprise, and below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13 for Splunk Cloud Platform. The CVSS 3.1 score of 7.5 indicates a high impact on confidentiality, integrity, and availability, requiring low privileges but with high attack complexity. The vulnerability is publicly known but no vendor advisory or patch information is provided in the input data.
Potential Impact
An attacker or unauthorized user with access to the _internal index can obtain sensitive information such as session cookies and response bodies, potentially leading to exposure of sensitive user data and guidance for further attacks. This compromises confidentiality and integrity of the system data and can affect availability due to the high CVSS impact metrics.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the _internal index to only trusted users and roles to minimize exposure. Monitor for updates from Splunk regarding patches or configuration changes that address this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2025-10-08T11:59:15.400Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0df486ba1db4736293a1c3
Added to database: 05/20/2026, 17:51:02 UTC
Last enriched: 05/27/2026, 21:00:11 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.