Inclusion of Sensitive Information in Log Files in Splunk Enterprise - CVE-2026-20144
Published: February 19, 2026
Vulnerability identifier: #VU123090
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-20144
CWE-ID: CWE-532
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files in splunkd. A remote user who holds a role with access to the Splunk _internal index could view the Security Assertion Markup Language (SAML) configurations for “Attribute query requests” (AQRs) or “Authentication extensions” in plain text within the conf.log file.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-20144
Install updates from vendor's website.
Splunk Enterprise - addressed in versions 9.2.11, 9.3.8, 9.4.7, 10.0.2