CVE-2025-20230: Splunk Enterprise Privilege Escalation Flaw

CVE-2025-20230 Overview

CVE-2025-20230 is an access control vulnerability in Splunk Enterprise and the Splunk Secure Gateway app on Splunk Cloud Platform. The flaw allows a low-privileged authenticated user without admin or power roles to edit and delete data belonging to other users. The affected data resides in App Key Value Store (KVStore) collections created by the Splunk Secure Gateway app. The issue stems from missing access control checks and incorrect ownership assignment, where the nobody user owned records instead of the actual data owner [CWE-284].

Critical Impact
Authenticated low-privileged users can tamper with or destroy KVStore data belonging to other Splunk users, undermining data integrity across Secure Gateway collections.

Affected Products

Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8
Splunk Secure Gateway app versions below 3.8.38 on Splunk Cloud Platform
Splunk Secure Gateway app versions below 3.7.23 on Splunk Cloud Platform

Discovery Timeline

2025-03-26 - CVE-2025-20230 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20230

Vulnerability Analysis

The vulnerability affects how the Splunk Secure Gateway app manages ownership and access control for records stored in App Key Value Store (KVStore) collections. In vulnerable versions, records created within these collections were owned by the internal nobody user rather than the actual user who generated the data. Because no specific owner was bound to each record, the app failed to enforce per-user ownership boundaries. A user authenticated to Splunk without the admin or power role could send KVStore edit or delete requests targeting entries produced by other users. The result is unauthorized modification and deletion of another user's data within Secure Gateway collections.

Root Cause

The root cause is a combination of missing access control [CWE-284] and incorrect ownership assignment on KVStore records. The nobody user acted as the default owner for all data in the affected collections. Without a distinct owner attached to each record, Splunk's role-based access checks could not distinguish between the record creator and other authenticated users. This design gap allowed cross-user write and delete operations.

Attack Vector

Exploitation requires network access to the Splunk instance and valid credentials for any low-privileged Splunk role. The attacker interacts with the Secure Gateway KVStore collections through Splunk's REST API endpoints for KVStore operations. No user interaction is required from other users. The impact is limited to integrity, since the flaw does not expose confidentiality or availability of the underlying Splunk service.

No verified public proof-of-concept code is available. See the Splunk Security Advisory SVD-2025-0307 for vendor technical details.

Detection Methods for CVE-2025-20230

Indicators of Compromise

Unexpected DELETE or POST requests to /servicesNS/nobody/splunk_secure_gateway/storage/collections/data/* endpoints originating from non-admin accounts.
KVStore records in Secure Gateway collections with modification timestamps that do not correlate with the associated user's activity.
Splunk audit log entries showing low-privileged users successfully modifying KVStore entries they did not create.

Detection Strategies

Review Splunk _audit and _internal indexes for KVStore write and delete operations tied to accounts lacking admin or power roles.
Correlate REST API access logs against user role assignments to identify cross-user modifications in Secure Gateway collections.
Baseline normal Secure Gateway KVStore activity per user and alert on deviations, particularly bulk edits or deletions.

Monitoring Recommendations

Enable verbose REST endpoint auditing for the splunk_secure_gateway app and forward these events to a centralized analytics platform.
Monitor for enumeration patterns against /storage/collections/data/ endpoints performed by non-privileged sessions.
Track changes to KVStore collection ownership metadata and flag records where the owner attribute deviates from expected values.

How to Mitigate CVE-2025-20230

Immediate Actions Required

Upgrade Splunk Enterprise to 9.4.1, 9.3.3, 9.2.5, 9.1.8, or later as applicable to your deployment branch.
Upgrade the Splunk Secure Gateway app to version 3.8.38 or 3.7.23 or later on Splunk Cloud Platform.
Audit existing Secure Gateway KVStore collections for unauthorized modifications performed prior to patching.

Patch Information

Splunk has released fixed versions that correct ownership assignment and enforce access control on Secure Gateway KVStore collections. Refer to the Splunk Security Advisory SVD-2025-0307 for the complete list of fixed builds and upgrade guidance.

Workarounds

If patching is not immediately possible, restrict Splunk login to trusted users only and remove low-privileged accounts that do not require Secure Gateway functionality.
Disable the Splunk Secure Gateway app in environments where mobile alerting features are not in use.
Apply role-based restrictions that block access to /servicesNS/nobody/splunk_secure_gateway/storage/collections/data/* endpoints for non-privileged users through a reverse proxy or Splunk capability configuration.

bash

# Configuration example: disable Splunk Secure Gateway app pending upgrade
# Edit $SPLUNK_HOME/etc/apps/splunk_secure_gateway/local/app.conf
[install]
state = disabled

# Then restart Splunk
$SPLUNK_HOME/bin/splunk restart