CVE-2026-20144

MEDIUM

6.8

Descripcion

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the the Splunk _internal index could view the Security Assertion Markup Language (SAML) configurations for Attribute query requests (AQRs) or Authentication extensions in plain text within the conf.log file, depending on which feature is configured.

Detalles CVE

Puntuacion CVSS v3.16.8

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueADJACENT_NETWORK

ComplejidadLOW

Privilegios requeridosHIGH

Interaccion usuarioNONE

Publicado2/18/2026

Ultima modificacion2/23/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

splunk:splunksplunk:splunk_cloud_platform

Debilidades (CWE)

CWE-532

Referencias

https://advisory.splunk.com/advisories/SVD-2026-0209(psirt@cisco.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.