CVE-2026-20296: Splunk Enterprise CSRF Vulnerability

CVE-2026-20296 Overview

CVE-2026-20296 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Splunk Enterprise and Splunk Cloud Platform. Deployment Server endpoints in Splunk Web fail to validate CSRF tokens on GET requests. Caller-supplied input is also not neutralized before it is placed into a Search Processing Language (SPL) search.

An attacker can trick a user with the list_deployment_server capability into executing arbitrary SPL searches. Those searches run as the splunk-system-user, granting access to stored credentials and indexed data.

Critical Impact
Exploitation exposes stored credentials and indexed data by executing attacker-controlled SPL as the privileged splunk-system-user.

Affected Products

Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13
Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24
Deployment Server component in Splunk Web

Discovery Timeline

2026-07-15 - CVE-2026-20296 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-20296

Vulnerability Analysis

The flaw combines two weaknesses in the Deployment Server component of Splunk Web. First, GET request handlers on Deployment Server endpoints do not verify anti-CSRF tokens. Second, user-supplied parameters flow into SPL search construction without proper neutralization.

When chained, these weaknesses let an attacker craft a malicious link or embedded resource. A victim holding the list_deployment_server capability triggers the request simply by loading attacker-controlled content while authenticated to Splunk Web.

The crafted request executes arbitrary SPL under the splunk-system-user context. This system identity has broad access to indexed data and stored credentials used by inputs, forwarders, and deployment configurations.

Root Cause

The root cause is missing CSRF token validation on GET endpoints combined with improper input neutralization. Splunk's SPL construction path trusts caller-supplied values that should be sanitized or parameterized. The design fails both defense layers, so a single crafted request achieves privileged search execution.

Attack Vector

Exploitation requires network access and user interaction but no privileges on the target. The attacker delivers a malicious URL through phishing, a compromised page, or an embedded image tag. When the authenticated victim's browser issues the GET request, Splunk Web processes the injected SPL as the victim.

Because the executing identity is splunk-system-user, the attacker can read indexed events, retrieve credentials from the credential store, and pivot to further Splunk resources. Refer to the Splunk Security Advisory SVD-2026-0702 for authoritative technical details.

Detection Methods for CVE-2026-20296

Indicators of Compromise

Unexpected SPL searches in audit.log executed as splunk-system-user with a search_id that originates from a Deployment Server endpoint
HTTP GET requests to Deployment Server endpoints in Splunk Web access logs containing SPL fragments or metacharacters in query parameters
Referer headers on Deployment Server GET requests pointing to external or untrusted origins

Detection Strategies

Correlate Splunk Web access logs with _audit index entries to identify searches attributed to splunk-system-user that were initiated via HTTP GET rather than internal scheduling
Alert on Deployment Server endpoint requests that include unexpected SPL keywords such as search, rest, dump, or outputlookup within URL parameters
Baseline normal Deployment Server usage per user and flag anomalous request rates or off-hours activity

Monitoring Recommendations

Monitor accounts assigned the list_deployment_server capability and review their recent web session activity
Enable detailed HTTP access logging on Splunk Web and forward it to a centralized SIEM for correlation
Track credential store access events and searches touching sensitive indexes for anomalies following the disclosure window

How to Mitigate CVE-2026-20296

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.1, 10.2.5, 10.0.8, 9.4.13, or later maintenance release on the corresponding branch
Confirm Splunk Cloud Platform instances have been upgraded by Splunk to 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, or 10.1.2507.24
Audit role assignments and remove the list_deployment_server capability from users who do not require it

Patch Information

Splunk has released fixed versions in both Splunk Enterprise and Splunk Cloud Platform. See the Splunk Security Advisory SVD-2026-0702 for the complete list of patched releases and upgrade guidance.

Workarounds

Restrict the list_deployment_server capability to a minimal set of trusted administrators until patches are applied
Enforce strict browsing hygiene for Splunk administrators, including isolated browsers or sessions for Splunk Web access
Place Splunk Web behind an authenticating reverse proxy that enforces same-origin and Referer checks on GET requests to Deployment Server paths

bash

# Review users granted the list_deployment_server capability
$SPLUNK_HOME/bin/splunk btool authorize list --debug \
  | grep -E 'list_deployment_server|\[role_'