CVE-2026-20137: Splunk

Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days.

In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122, a low-privileged user who does not hold the "admin" or "power" Splunk roles could bypass the SPL safeguards for risky commands when they create a Data Model that contains an injected SPL query within an object. They can bypass the safeguards by exploiting a path traversal vulnerability.

Affected products

• Splunk Splunk: from 9.2.0, before 9.2.9 (fixed in 9.2.9); from 9.3.0, before 9.3.7 (fixed in 9.3.7); from 9.4.0, before 9.4.5 (fixed in 9.4.5); from 10.0.0, before 10.0.3 (fixed in 10.0.3)
• Splunk Splunk Cloud Platform: from 9.3.2408, before 9.3.2408.122 (fixed in 9.3.2408.122); from 9.3.2411, before 9.3.2411.112 (fixed in 9.3.2411.112); from 10.0.2503, before 10.0.2503.9 (fixed in 10.0.2503.9); version 10.1.2507 only

Published 2026-02-18. Last modified 2026-06-17.