CVE-2026-20138: Splunk Enterprise Information Disclosure

CVE-2026-20138 Overview

CVE-2026-20138 is an information disclosure vulnerability in Splunk Enterprise Search Head Cluster (SHC) deployments. Authenticated users with a role granting access to the Splunk _internal index can read Duo Two-Factor Authentication secrets in plain text. The exposed values include the integrationKey, secretKey, and appSecretKey generated by the Duo MFA integration for Splunk Enterprise. The flaw stems from improper logging of sensitive credentials, classified under CWE-532: Insertion of Sensitive Information into Log File. Splunk addressed the issue in advisory SVD-2026-0203.

Critical Impact
An authenticated user with _internal index access can extract Duo MFA secrets and potentially undermine the integrity of two-factor authentication on the Splunk deployment.

Affected Products

Splunk Enterprise versions below 10.2.0
Splunk Enterprise versions below 10.0.2, 9.4.7, 9.3.9, and 9.2.11
Splunk Search Head Cluster (SHC) deployments using Duo Two-Factor Authentication

Discovery Timeline

2026-02-18 - CVE-2026-20138 published to NVD
2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-20138

Vulnerability Analysis

The vulnerability resides in how the Duo Two-Factor Authentication app for Splunk Enterprise handles its configured secrets within a Search Head Cluster. When the integration runs, it writes the integrationKey, secretKey, and appSecretKey to log files that are ingested into the Splunk _internal index. Any Splunk user holding a role with search permissions on _internal can query these events and recover the plain text values.

The issue is an information exposure flaw, not a remote code execution or authentication bypass. Exploitation requires existing authenticated access with elevated index privileges. Splunk operators commonly grant _internal access to administrators, support engineers, and monitoring roles, expanding the effective exposure surface.

An attacker who recovers these secrets gains the cryptographic material that the Duo integration uses to sign API requests. This material can be leveraged to forge Duo API interactions, bypass MFA flows tied to the Splunk integration, or pivot against the broader Duo tenant configuration.

Root Cause

The root cause is the unintentional inclusion of sensitive secret values in events written to the _internal index. The Duo integration did not redact or hash the integrationKey, secretKey, and appSecretKey fields before they reached Splunk's internal logs. This is a classic [CWE-532] pattern where credentials intended for runtime memory are persisted in cleartext log records.

Attack Vector

Exploitation requires an authenticated Splunk user with high privileges, specifically a role that grants read access to the _internal index. The attacker runs a standard Splunk search against _internal and filters for the log events containing the Duo configuration secrets. No special tooling or network position is needed beyond access to the Splunk Web or REST search interface. The vulnerability does not impact integrity or availability of Splunk itself, but it compromises the confidentiality of MFA credentials.

Detection Methods for CVE-2026-20138

Indicators of Compromise

Splunk search activity from non-administrative accounts targeting the _internal index with filters referencing integrationKey, secretKey, or appSecretKey.
Audit log entries in _audit showing searches against Duo-related sourcetypes by users outside expected operational roles.
Unexpected Duo API activity correlated with the integrationKey belonging to the Splunk integration.

Detection Strategies

Review Splunk _audit index for historical searches that may have returned Duo secret fields, focusing on the timeframe before patching.
Hunt for the literal strings integrationKey, secretKey, and appSecretKey in saved searches, dashboards, and scheduled reports.
Correlate Duo administration logs with Splunk search activity to identify anomalous API calls signed with the exposed keys.

Monitoring Recommendations

Restrict and continuously audit which roles are granted read access to the _internal index in Search Head Cluster deployments.
Alert on any search containing Duo secret field names executed by non-service accounts.
Monitor Duo admin panel for unexpected integration usage, new application registrations, or modified policies.

How to Mitigate CVE-2026-20138

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.2.0, 10.0.2, 9.4.7, 9.3.9, or 9.2.11 or later as published in SVD-2026-0203.
Rotate the Duo integrationKey, secretKey, and appSecretKey after upgrading, treating the previous values as compromised.
Audit role definitions and remove _internal index access from any user or role that does not strictly require it.

Patch Information

Splunk has released fixed versions in the 10.2.x, 10.0.x, 9.4.x, 9.3.x, and 9.2.x branches. Refer to the Splunk Security Advisory SVD-2026-0203 for the complete list of fixed builds and download locations. After patching, validate that newly written _internal events no longer contain the Duo secret fields in cleartext.

Workarounds

If immediate patching is not possible, revoke _internal index access from all non-administrative roles in Search Head Cluster deployments.
Consider temporarily disabling the Duo Two-Factor Authentication for Splunk Enterprise integration if exposure cannot be contained.
Use Splunk role-based access controls to limit search capability to a narrow set of trusted administrators until the upgrade is applied.

bash

# Configuration example: review roles with _internal access via Splunk REST API
curl -k -u admin:<password> \
  https://<splunk-host>:8089/services/authorization/roles \
  -d output_mode=json | \
  jq '.entry[] | select(.content.srchIndexesAllowed[]? == "_internal") | .name'