CVE-2025-20226: Splunk Enterprise Auth Bypass Vulnerability

CVE-2025-20226 Overview

CVE-2025-20226 is an information disclosure vulnerability in Splunk Enterprise and Splunk Cloud Platform. A low-privileged authenticated user without the admin or power role can trigger a saved search containing a risky Search Processing Language (SPL) command. The saved search executes with the permissions of a higher-privileged user, bypassing the SPL safeguards enforced on the /services/streams/search endpoint through its q parameter. Exploitation requires the attacker to phish a victim and trick them into initiating the request in their browser, which limits at-will exploitation. The issue is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact

A phished, higher-privileged Splunk user can be coerced into executing risky SPL commands on behalf of a low-privileged attacker, leading to unauthorized disclosure of data accessible via the streams search endpoint.

Affected Products

• Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8
• Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214
• Splunk Enterprise 9.4.0

Discovery Timeline

• 2025-03-26 - CVE-2025-20226 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20226

Vulnerability Analysis

The flaw resides in how Splunk enforces SPL safeguards for risky commands on the /services/streams/search REST endpoint. When a saved search containing a risky command in the q parameter is executed, Splunk applies the safeguards based on the invoking session context rather than strictly validating the effective permissions of the saved search owner. A user without the admin or power role can craft a saved search that references a risky SPL command and rely on a higher-privileged user to initiate execution. The result is a privilege boundary bypass that allows sensitive data disclosure through search results the low-privileged user could not otherwise obtain.

Root Cause

The root cause is improper enforcement of role-based restrictions on risky SPL commands when saved searches are invoked through the streaming search endpoint. Splunk's safeguard logic evaluates the request path and search context in a way that permits inherited elevated permissions to override the low-privileged caller's restrictions. This is a business logic flaw combined with insufficient authorization validation on the q parameter.

Attack Vector

The attack requires an authenticated low-privileged Splunk account and user interaction from a higher-privileged victim. The attacker stages a saved search containing a risky SPL command, then delivers a phishing lure that causes the victim's authenticated browser to issue a request to /services/streams/search. Because the saved search runs with the victim's elevated permissions, the risky command executes and returns data to the workflow the attacker controls. The attacker cannot exploit the vulnerability at will and depends on successful social engineering.

No verified public proof-of-concept code is available. Refer to the Splunk Security Advisory SVD-2025-0305 for vendor technical details.

Detection Methods for CVE-2025-20226

Indicators of Compromise

• Requests to /services/streams/search originating from browser sessions of admin or power role users that reference saved searches owned by lower-privileged accounts.
• Saved searches authored by non-privileged users that contain risky SPL commands such as collect, delete, outputlookup, run, script, or sendemail.
• Unexpected referrer headers on streams search requests pointing to external or untrusted origins.

Detection Strategies

• Audit Splunk internal logs (_audit, _internal) for saved search executions where the search owner and the invoking user differ in role tier.
• Correlate search.log entries invoking risky SPL commands with the originating REST endpoint to identify safeguard bypass patterns.
• Baseline normal use of /services/streams/search and alert on cross-role invocations of user-owned saved searches.

Monitoring Recommendations

• Enable and forward Splunk audit logs to a centralized SIEM for cross-tenant correlation of search execution events.
• Monitor for phishing indicators targeting Splunk administrators, including URLs referencing /services/streams/search with a q parameter.
• Track creation and modification of saved searches by low-privileged users and flag any that reference risky SPL commands.

How to Mitigate CVE-2025-20226

Immediate Actions Required

• Upgrade Splunk Enterprise to version 9.4.1, 9.3.3, 9.2.5, 9.1.8, or later as applicable to your deployment.
• Confirm Splunk Cloud Platform instances are upgraded to 9.3.2408.107, 9.2.2406.111, 9.1.2308.214, or later (Splunk manages Cloud upgrades).
• Review saved searches created by non-admin and non-power users for risky SPL commands and remove or quarantine suspicious entries.

Patch Information

Splunk addressed the vulnerability in Splunk Enterprise 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and in Splunk Cloud Platform 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214. Full remediation details are available in the Splunk Security Advisory SVD-2025-0305.

Workarounds

• Restrict which roles can create or share saved searches referencing risky SPL commands through role capability configuration.
• Enforce browser-side protections against cross-site request forgery by keeping administrative sessions isolated from general browsing.
• Provide targeted phishing awareness training to users holding admin or power Splunk roles.

# Example: identify saved searches referencing risky SPL commands
# Run in Splunk Search & Reporting as an administrator
| rest /servicesNS/-/-/saved/searches
| search search="*collect*" OR search="*delete*" OR search="*outputlookup*" OR search="*sendemail*" OR search="*run*" OR search="*script*"
| table title author search eai:acl.owner eai:acl.sharing