CVE-2026-20139: Splunk Enterprise DoS Vulnerability

CVE-2026-20139 Overview

CVE-2026-20139 is a client-side denial-of-service (DoS) vulnerability affecting Splunk Enterprise and Splunk Cloud Platform. The flaw allows a low-privileged authenticated user, lacking the admin or power Splunk role, to inject a malicious payload into the realname, tz, or email parameters of the /splunkd/__raw/services/authentication/users/username REST API endpoint during a password change. The payload causes Splunk Web to slow significantly or become temporarily unresponsive when rendered. The vulnerability is tracked under CWE-400: Uncontrolled Resource Consumption.

Critical Impact

Authenticated low-privileged users can degrade Splunk Web availability for other users by injecting crafted payloads into user profile fields exposed through the authentication REST API.

Affected Products

• Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12
• Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121
• Splunk Web component shipped with the affected releases

Discovery Timeline

• 2026-02-18 - CVE-2026-20139 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-20139

Vulnerability Analysis

The vulnerability exists in the user profile update flow handled by the /splunkd/__raw/services/authentication/users/username REST API endpoint. When a user changes their password, the endpoint accepts attribute updates for the realname, tz, and email parameters without enforcing constraints sufficient to prevent resource-intensive content from being stored. Once persisted, Splunk Web retrieves and renders these attributes in its frontend interface.

The rendering pipeline does not adequately validate the size or structure of the supplied values. A crafted payload submitted by a low-privileged user is therefore returned to any client that loads pages referencing the affected user record, where it consumes excessive browser resources. The result is a client-side denial-of-service condition that slows page loads or freezes Splunk Web sessions.

The attack requires authentication but does not require admin or power role membership. The integrity and confidentiality of stored data are unaffected; only availability of the Splunk Web user interface is impacted.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] in the handling of user-controlled profile attributes. The affected REST endpoint accepts and stores arbitrary content in the realname, tz, and email fields without enforcing length, character set, or structural validation. Splunk Web then processes this content client-side without protective rendering limits.

Attack Vector

An authenticated attacker sends a POST request to the /splunkd/__raw/services/authentication/users/username endpoint during a password change operation. The request body includes a malicious payload in one or more of the realname, tz, or email parameters. The payload is persisted in the user record. When another user or administrator navigates to a Splunk Web page that renders the modified profile fields, the browser session degrades or becomes unresponsive.

The vulnerability is described in prose only because no public proof-of-concept code is available. Refer to the Splunk Security Advisory SVD-2026-0204 for vendor technical details.

Detection Methods for CVE-2026-20139

Indicators of Compromise

• POST or PUT requests to /splunkd/__raw/services/authentication/users/<username> originating from non-administrative accounts and containing unusually large realname, tz, or email field values.
• User records where the realname, tz, or email attributes contain non-standard characters, repeated patterns, or values exceeding typical length expectations.
• Splunk Web user reports of unresponsive pages, browser hangs, or unusually long load times when viewing user management or related dashboards.

Detection Strategies

• Audit the _audit index for action=edit_user events and inspect parameter values supplied for realname, tz, and email.
• Build a search that flags user-profile updates where field length exceeds an organizational baseline, for example values longer than 256 characters.
• Correlate password-change events from non-privileged accounts with subsequent reports of Splunk Web performance degradation.

Monitoring Recommendations

• Enable verbose audit logging on the authentication/users REST endpoint and forward logs to a centralized analytics platform for review.
• Monitor browser-side performance telemetry from administrators who access user management interfaces.
• Track the distribution of user role assignments and review any password-change activity from accounts without admin or power roles.

How to Mitigate CVE-2026-20139

Immediate Actions Required

• Upgrade Splunk Enterprise to version 10.2.0, 10.0.2, 9.4.8, 9.3.9, 9.2.12, or later as appropriate for your maintenance track.
• Confirm that Splunk Cloud Platform tenants are running version 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, 9.3.2411.121, or later.
• Review existing user accounts for anomalously large or malformed realname, tz, or email values and sanitize them.

Patch Information

Splunk has released fixed versions across all supported maintenance tracks. Apply the upgrades listed in the Splunk Security Advisory SVD-2026-0204. Splunk Cloud Platform customers receive patches through the standard Splunk-managed update process.

Workarounds

• Restrict use of the password-change workflow to trusted authentication paths and consider integrating an external identity provider that bypasses the affected endpoint.
• Apply network or proxy-level input size limits on requests to /splunkd/__raw/services/authentication/users/.
• Audit and minimize the number of accounts that can authenticate to Splunk Web until upgrades are deployed.

# Configuration example: verify installed Splunk version before and after upgrade
$SPLUNK_HOME/bin/splunk version

# Example REST query to enumerate user attribute lengths for review
curl -k -u admin:<password> \
  https://splunk.example.com:8089/services/authentication/users \
  --get -d output_mode=json | \
  jq '.entry[] | {name: .name, realname_len: (.content.realname|length), email_len: (.content.email|length)}'