Improper access control in Splunk Enterprise - CVE-2026-20141
Published: February 19, 2026
Vulnerability identifier: #VU123094
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-20141
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user who does not hold the “admin” Splunk role can access the Splunk Monitoring Console App endpoints and gain access to sensitive information.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-20141
Install updates from vendor's website.
Splunk Enterprise - addressed in versions 9.3.9, 9.4.8, 10.0.3