CVE-2026-20165: 
Splunk Enterprise vulnerability analysis and mitigation

CVE-2026-20165 is a sensitive information disclosure vulnerability in Splunk Enterprise and Splunk Cloud Platform caused by improper access control in the MongoClient logging channel. A low-privileged user without the "admin" or "power" Splunk roles can retrieve sensitive information by inspecting a job's search log. Affected Splunk Enterprise versions are below 10.2.1, 10.0.4, 9.4.9, and 9.3.10; affected Splunk Cloud Platform versions are below 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9.3.2411.124. The vulnerability was disclosed on March 11, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Splunk Advisory).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File), where the MongoClient logging channel in Splunk improperly exposes sensitive data to job search logs without enforcing adequate role-based access controls. An authenticated low-privileged user (any role below "admin" or "power") can exploit this over the network with low attack complexity and no user interaction required, simply by inspecting the search job logs accessible through the Splunk interface. No special configuration or elevated privileges beyond a basic Splunk account are needed to trigger the information disclosure (Splunk Advisory).

Successful exploitation allows low-privileged users to access sensitive information that should be restricted to higher-privileged roles, resulting in a high confidentiality impact with no integrity or availability impact. The exposed data originates from MongoClient logging within search job logs, which may include connection strings, credentials, or other sensitive operational data depending on the deployment configuration. The scope is limited to the affected Splunk instance, but exposure of such data could facilitate lateral movement or privilege escalation within the broader environment (Splunk Advisory).

There is no public proof-of-concept exploit available and no evidence of active in-the-wild exploitation as of the time of disclosure (Splunk Advisory). The EPSS score is approximately 0.037%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage is available via Tenable Nessus plugin 301872 (Tenable).

1. Authentication: Log in to the target Splunk instance using any low-privileged account (i.e., a user without the "admin" or "power" role).
2. Trigger a search job: Initiate or identify an existing search job that involves MongoClient operations, which will generate entries in the job's search log.
3. Access the job search log: Navigate to the job's search log via the Splunk UI or API (e.g., using the GET /services/search/jobs/{sid}/log endpoint) to retrieve the log contents.
4. Extract sensitive information: Review the MongoClient logging channel entries within the search log for sensitive data such as connection strings, credentials, or internal configuration details that are improperly written to the log (Splunk Advisory).

• Logs: Splunk audit logs showing low-privileged users (non-admin, non-power roles) repeatedly accessing job search logs via the UI or REST API (/services/search/jobs/{sid}/log).
• Logs: Unusual volume of job log access requests from accounts that do not typically perform administrative or investigative tasks.
• Network: REST API calls to job log endpoints originating from unexpected source IPs or user accounts.
• Behavioral: Low-privileged user accounts querying search job logs for jobs they did not initiate, particularly jobs involving database or MongoClient operations (Splunk Advisory).

Splunk has released patched versions addressing this vulnerability. For Splunk Enterprise, upgrade to version 10.2.1, 10.0.4, 9.4.9, or 9.3.10 (or later). For Splunk Cloud Platform, upgrade to 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, or 9.3.2411.124 (or later). As interim mitigations, administrators should review and restrict access to job search logs for low-privileged users, implement network segmentation to limit access to Splunk instances, and monitor access logs for suspicious inspection of job search logs by non-admin users (Splunk Advisory).