CVE-2026-20137: 
Splunk Enterprise vulnerability analysis and mitigation

CVE-2026-20137 is a path traversal and SPL injection vulnerability in Splunk Enterprise and Splunk Cloud Platform that allows low-privileged users to bypass SPL safeguards for risky commands. Affected Splunk Enterprise versions include all releases below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9; affected Splunk Cloud Platform versions include those below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122. The vulnerability was published on February 18, 2026, with a patch advisory released on February 20, 2026. It carries a CVSS v3.1 base score of 5.7 (Medium) (Feedly).

The vulnerability is rooted in two weaknesses: CWE-22 (Path Traversal) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). A low-privileged user — one who does not hold the "admin" or "power" Splunk roles — can create a Data Model containing an injected SPL (Search Processing Language) query within an object. By exploiting a path traversal flaw in how Splunk processes these Data Model definitions, the attacker can bypass the SPL safeguards that are designed to prevent execution of risky or restricted commands. The attack vector is network-based, requires low privileges, and necessitates user interaction to trigger (Feedly, Infinitsec).

Successful exploitation allows a low-privileged attacker to execute restricted SPL commands that would normally be blocked by Splunk's risky command safeguards, leading to unauthorized exposure of sensitive information accessible within the Splunk instance. The confidentiality impact is rated High, while integrity and availability are unaffected. Because Splunk environments often index sensitive operational, security, and business data, unauthorized access to this data could facilitate further reconnaissance or lateral movement within an organization (Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.027%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage is available via Qualys (detection ID 530970) and Tenable (Nessus plugin 299413) (Feedly, Tenable).

1. Reconnaissance: Identify a Splunk Enterprise or Splunk Cloud Platform instance running a vulnerable version (Enterprise below 10.2.0/10.0.3/9.4.5/9.3.7/9.2.9; Cloud Platform below 10.1.2507.0/10.0.2503.9/9.3.2411.112/9.3.2408.122) using network scanning or Shodan.
2. Obtain low-privileged access: Authenticate to the Splunk instance with any valid account that does not hold the "admin" or "power" role.
3. Craft malicious Data Model: Create a new Data Model and embed an injected SPL query within a Data Model object, leveraging path traversal sequences in the object definition to bypass input validation.
4. Trigger safeguard bypass: Submit or save the crafted Data Model, causing Splunk to process the injected SPL query through a code path that circumvents the risky command safeguards.
5. Execute restricted SPL commands: The injected SPL query executes restricted or risky commands, potentially returning sensitive data indexed in the Splunk environment to the attacker (Feedly, Infinitsec).

• Logs: Splunk audit logs showing Data Model creation or modification events by low-privileged users (non-admin, non-power roles), especially with unusual object names or query strings containing path traversal sequences (e.g., ../, %2e%2e%2f).
• Logs: Execution of SPL commands flagged as "risky" or restricted in Splunk's search audit logs, initiated by accounts without admin/power roles.
• Network: Unexpected or high-volume search results returned to low-privileged user sessions, potentially indicating unauthorized data access.
• File System: Unusual Data Model definition files stored in Splunk's data model directory containing embedded SPL queries or path traversal patterns (Feedly).

Upgrade Splunk Enterprise to version 9.2.9, 9.3.7, 9.4.5, 10.0.3, or 10.2.0 (or later within each branch). For Splunk Cloud Platform, update to version 9.3.2408.122, 9.3.2411.112, 10.0.2503.9, or 10.1.2507.0 (or later). As a configuration-based workaround, restrict Data Model creation and modification permissions to trusted users only, and monitor Data Model creation activities for suspicious patterns. Organizations should prioritize patching given that low-privileged users can exploit this without admin credentials (Feedly, Splunk Advisory).

Coverage of CVE-2026-20137 has been limited to vulnerability aggregation platforms and security tooling vendors. Tenable released detection plugins (Nessus plugin 299413) shortly after disclosure, and Qualys added detection support (ID 530970). The Egyptian Financial Institutions CIRT published a Splunk security update notice referencing the vulnerability. No notable researcher commentary or significant social media discussion has been observed (Tenable, Feedly).