CVE-2026-20298 Overview
CVE-2026-20298 is an information disclosure vulnerability [CWE-200] in Splunk Enterprise and Splunk Cloud Platform. A low-privileged user without the admin or power role can view stored credential hashes. The exposure occurs when the user queries the /servicesNS/-/-/storage/passwords REST endpoint through the |rest Search Processing Language (SPL) command. The endpoint returns the encr_password field in the results, exposing sensitive credential material to unauthorized users.
Critical Impact
Low-privileged Splunk users can retrieve encrypted credential hashes stored in the platform, enabling offline cracking attempts and potential lateral movement across integrated systems.
Affected Products
- Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13
- Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24
- Deployments allowing non-admin, non-power Splunk role users to execute SPL search queries
Discovery Timeline
- 2026-07-15 - CVE-2026-20298 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-20298
Vulnerability Analysis
The vulnerability exists in how Splunk's |rest SPL command handles output from the /servicesNS/-/-/storage/passwords REST endpoint. The endpoint stores encrypted passwords for external system integrations, service accounts, and data source connectors. Under normal access controls, only users with the admin or power role should view these credentials.
The |rest SPL command bypasses the intended access restriction. When a low-privileged user issues a search containing |rest /servicesNS/-/-/storage/passwords, Splunk returns the encr_password field along with credential metadata. This field contains the stored credential hash rather than a masked value.
An attacker with authenticated access can enumerate stored credentials for integrated services, LDAP binds, cloud connectors, and forwarder configurations. Offline cracking of the returned hashes may yield plaintext credentials, enabling lateral movement into connected systems.
Root Cause
The root cause is inconsistent authorization enforcement between the direct REST endpoint and the |rest SPL command wrapper. The |rest command does not strip the encr_password field from results before returning them to callers who lack the admin or power role. This represents a broken access control condition [CWE-200] where sensitive fields leak through an alternate access path.
Attack Vector
Exploitation requires an authenticated Splunk account with search privileges but no administrative role. The attacker submits an SPL query invoking |rest against the passwords storage endpoint. Splunk returns credential entries including the encrypted password field. No user interaction, memory corruption, or code execution is required. Attack complexity is elevated because the attacker must hold valid Splunk credentials and understand the specific SPL syntax and endpoint path.
See the Splunk Security Advisory SVD-2026-0704 for vendor technical details.
Detection Methods for CVE-2026-20298
Indicators of Compromise
- Audit log entries showing |rest SPL command execution referencing /servicesNS/-/-/storage/passwords
- Search queries from non-admin, non-power role users targeting the storage/passwords REST path
- Unexpected access to the encr_password field in search results or exported artifacts
- Anomalous credential authentication failures on systems integrated with Splunk following suspicious searches
Detection Strategies
- Enable Splunk audit logging (audit.log) and alert on SPL searches containing the string storage/passwords executed by users outside the admin or power roles
- Correlate |rest command usage with subsequent outbound authentication attempts to integrated services
- Baseline normal |rest command usage per user role and flag deviations
Monitoring Recommendations
- Forward Splunk _audit index events to an external SIEM or data lake for tamper-resistant review
- Review scheduled searches, saved searches, and dashboards for embedded queries referencing storage/passwords
- Monitor role assignments and capability grants for unauthorized elevation of search privileges
How to Mitigate CVE-2026-20298
Immediate Actions Required
- Upgrade Splunk Enterprise to version 10.4.1, 10.2.5, 10.0.8, or 9.4.13 or later according to your deployment branch
- Confirm Splunk Cloud Platform instances have been updated to 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, or 10.1.2507.24
- Rotate all credentials stored in storage/passwords if audit logs show unauthorized access to the endpoint
- Review user role assignments and remove unnecessary search capabilities from low-privileged accounts
Patch Information
Splunk addressed the issue in the fixed versions listed above. The patch prevents the |rest SPL command from returning the encr_password field to users lacking the admin or power role. Refer to Splunk Security Advisory SVD-2026-0704 for the complete list of affected and fixed builds.
Workarounds
- Restrict use of the |rest SPL command by removing the rest_apps_management and related capabilities from non-administrative roles
- Deny access to the /servicesNS/-/-/storage/passwords endpoint at a reverse proxy or load balancer for non-admin sessions
- Rotate stored credentials and migrate high-value secrets to an external secrets manager where feasible
# Example: remove list_storage_passwords capability from a custom role
splunk edit role analyst -capability -list_storage_passwords -auth admin:<password>
splunk reload auth
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
