CVE-2025-20389: Splunk Secure Gateway DoS Vulnerability

CVE-2025-20389 Overview

CVE-2025-20389 affects Splunk Enterprise and the Splunk Secure Gateway app on Splunk Cloud Platform. A low-privileged authenticated user, without the admin or power Splunk roles, can craft a malicious payload in the label column field when adding a new device in the Splunk Secure Gateway app. The malformed input triggers a client-side denial of service (DoS) condition in the application UI. The issue is tracked under [CWE-20] Improper Input Validation and documented in Splunk Security Advisory SVD-2025-1208.

Critical Impact
An authenticated low-privileged user can render the Splunk Secure Gateway client interface unusable by submitting a malicious label field value.

Affected Products

Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10
Splunk Secure Gateway app on Splunk Cloud Platform below 3.9.10, 3.8.58, and 3.7.28
Splunk Cloud Platform instances running affected Splunk Secure Gateway versions

Discovery Timeline

2025-12-03 - CVE-2025-20389 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20389

Vulnerability Analysis

The vulnerability resides in the Splunk Secure Gateway app, which manages mobile device pairing for Splunk Mobile and related services. When a user adds a new device, the app accepts a label value that is later rendered client-side. Improper input validation on this field allows a crafted payload to break rendering logic and produce a denial of service against the client. The impact is confined to availability of the client interface. Confidentiality and integrity are not affected according to the CVSS vector components published by the vendor.

Root Cause

The root cause is Improper Input Validation [CWE-20] on the label column field in the device registration workflow of the Splunk Secure Gateway app. The application does not sufficiently sanitize or constrain the value before it is processed by the client. As a result, malformed content can cause the client-side view to hang or fail.

Attack Vector

Exploitation requires network access to the Splunk web interface and valid authentication as a non-privileged Splunk user. The attacker adds a new device in the Splunk Secure Gateway app and supplies a crafted label value. Users viewing the affected device list experience a client-side denial of service. No user interaction beyond normal navigation is required by victims.

No verified public code examples are available. Refer to Splunk Security Advisory SVD-2025-1208 for vendor technical details.

Detection Methods for CVE-2025-20389

Indicators of Compromise

Unexpected new device entries in the Splunk Secure Gateway app added by non-admin, non-power users.
Device label fields containing markup, script fragments, control characters, or unusually long strings.
User reports of unresponsive or broken Splunk Secure Gateway pages after loading the device list.

Detection Strategies

Audit Splunk _audit and _internal indexes for POST requests to Splunk Secure Gateway device registration endpoints originating from low-privileged accounts.
Correlate device additions with the Splunk role of the submitting user and alert on activity from accounts that lack admin or power roles.
Inspect stored label values in the Splunk Secure Gateway KV store for anomalous characters or oversized payloads.

Monitoring Recommendations

Enable and forward Splunk internal audit logs to a centralized analytics platform for review of Secure Gateway configuration changes.
Track the version of the Splunk Secure Gateway app across all search heads and cloud stacks to confirm patched releases are in place.
Alert on browser or client error telemetry from Splunk Web users accessing Secure Gateway views.

How to Mitigate CVE-2025-20389

Immediate Actions Required

Upgrade Splunk Enterprise to 10.0.2, 9.4.6, 9.3.8, or 9.2.10 or later depending on the deployed branch.
Upgrade the Splunk Secure Gateway app to 3.9.10, 3.8.58, or 3.7.28 or later on Splunk Cloud Platform and Splunk Enterprise.
Review Splunk role assignments and revoke unnecessary access to the Splunk Secure Gateway app.

Patch Information

Splunk has released fixed versions in Splunk Security Advisory SVD-2025-1208. Splunk Cloud Platform customers receive updates through the standard Splunk Cloud maintenance process. Splunk Enterprise customers must upgrade to a fixed release for their branch: 10.0.2, 9.4.6, 9.3.8, or 9.2.10.

Workarounds

Disable the Splunk Secure Gateway app if it is not required in the deployment.
Restrict access to the Splunk Secure Gateway app through role-based capability configuration so only trusted users can add devices.
Remove or sanitize any suspicious device entries created before patching to restore client-side functionality.

bash

# Disable the Splunk Secure Gateway app on an on-prem search head
$SPLUNK_HOME/bin/splunk disable app splunk_secure_gateway -auth admin:<password>
$SPLUNK_HOME/bin/splunk restart