CVE-2025-20366 Overview
CVE-2025-20366 is an information disclosure vulnerability in Splunk Enterprise and Splunk Cloud Platform. A low-privileged authenticated user who does not hold the admin or power Splunk roles can retrieve results from administrative search jobs running in the background. Access is gained by guessing the unique Search ID (SID) assigned to the job. Successful exploitation exposes sensitive search results intended for privileged users. The flaw is tracked under CWE-284: Improper Access Control and documented in Splunk Security Advisory SVD-2025-1001.
Critical Impact
Any authenticated low-privileged Splunk user who correctly guesses a running administrative search job's SID can retrieve its results, potentially exposing sensitive data from administrative queries.
Affected Products
- Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8
- Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122
- Deployments where administrative users run background search jobs accessible to standard authenticated users
Discovery Timeline
- 2025-10-01 - CVE-2025-20366 published to NVD
- 2026-10-18 - Last updated in NVD database
Technical Details for CVE-2025-20366
Vulnerability Analysis
Splunk assigns a unique Search ID (SID) to every search job created on the platform. The SID serves as the primary reference for retrieving job status, artifacts, and results through the REST API endpoint /services/search/jobs/{sid}/results. In affected versions, authorization checks on this endpoint do not fully validate whether the requesting user owns the search job or holds a role entitled to view it. A low-privileged user who supplies a valid SID for an administrative background job can retrieve the result set, bypassing the intended access boundary between roles. The vulnerability is categorized under CWE-284 Improper Access Control.
Root Cause
The root cause is inadequate role-based authorization enforcement on search job artifacts. The platform relies on the opacity of the SID rather than a strict ownership and role check at the API layer. When an administrator initiates a background search, the resulting SID becomes retrievable by any authenticated user who can enumerate or guess it, because the API returns results without re-validating that the caller satisfies the originating user's role scope.
Attack Vector
Exploitation requires network access to the Splunk management interface and valid credentials for any Splunk role, including non-privileged users. The attacker enumerates or guesses active SIDs — which follow structured patterns incorporating timestamps and user identifiers — and issues read requests against the search jobs REST endpoint. If an administrative background job matches the supplied SID, the API returns its results. No user interaction is required beyond authenticated API access.
No verified public proof-of-concept code is available for this issue. Refer to the Splunk Security Advisory SVD-2025-1001 for vendor-supplied technical details.
Detection Methods for CVE-2025-20366
Indicators of Compromise
- Anomalous volume of GET requests to /services/search/jobs/*/results or /services/search/v2/jobs/*/results from non-administrative accounts
- Successful job result retrievals where the requesting user does not match the search job owner recorded in audit.log
- Sequential or scripted SID enumeration patterns in Splunk internal access logs (splunkd_access.log)
- Low-privileged accounts accessing search artifacts shortly after an administrator initiates a background search
Detection Strategies
- Correlate entries in _audit and _internal indexes to identify mismatches between search job owners and result consumers
- Alert on any non-admin role issuing more than a threshold number of search/jobs/{sid} lookups within a short window
- Baseline normal REST API usage per role and flag deviations, particularly against the search jobs endpoint
Monitoring Recommendations
- Enable detailed REST API auditing on Splunk search heads and forward _audit logs to a central analytics platform
- Monitor for failed authorization events and iterative SID requests indicative of enumeration
- Review scheduled and ad-hoc administrative searches to identify sensitive queries that should not run while unpatched
How to Mitigate CVE-2025-20366
Immediate Actions Required
- Upgrade Splunk Enterprise to version 9.4.4, 9.3.6, or 9.2.8 or later as published in SVD-2025-1001
- Verify Splunk Cloud Platform instances are running 9.3.2411.111, 9.3.2408.119, 9.2.2406.122, or later
- Audit which non-admin accounts have accessed the search jobs REST endpoints since the exposure window began
- Rotate credentials for any administrative accounts whose background searches may have exposed sensitive data
Patch Information
Splunk released fixed builds in Splunk Enterprise 9.4.4, 9.3.6, and 9.2.8, and in Splunk Cloud Platform 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122. Patch details and upgrade procedures are published in Splunk Security Advisory SVD-2025-1001. Splunk Cloud Platform customers receive the fix through the standard cloud maintenance process.
Workarounds
- Avoid running administrative searches in the background on vulnerable instances; execute sensitive queries interactively and clear results promptly
- Restrict low-privileged user access to the search REST API endpoints via reverse proxy or network ACLs until patches are applied
- Review and tighten role capabilities so that only required accounts retain rest_properties_get and search job access capabilities
- Reference Splunk's About jobs and job management and Manage search jobs documentation for job lifecycle controls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
