CVE-2026-20166

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20166", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.390Z", "datePublished": "2026-03-11T16:18:17.121Z", "dateUpdated": "2026-03-12T16:19:30.880Z"}, "containers": {"cna": {"affected": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"version": "10.2", "status": "affected", "versionType": "custom", "lessThan": "10.2.1"}, {"version": "10.0", "status": "affected", "versionType": "custom", "lessThan": "10.0.4"}]}, {"product": "Splunk Cloud Platform", "vendor": "Splunk", "versions": [{"version": "10.2.2510", "status": "affected", "versionType": "custom", "lessThan": "10.2.2510.5"}, {"version": "10.1.2507", "status": "affected", "versionType": "custom", "lessThan": "10.1.2507.16"}, {"version": "10.0.2503", "status": "affected", "versionType": "custom", "lessThan": "10.0.2503.12"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could retrieve the Observability Cloud API access token through the Discover Splunk Observability Cloud app due to improper access control. \n\nThis vulnerability does not affect Splunk Enterprise versions below 9.4.9 and 9.3.10 because the Discover Splunk Observability Cloud app does not come with Splunk Enterprise."}], "value": "In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could retrieve the Observability Cloud API access token through the Discover Splunk Observability Cloud app due to improper access control. \n\nThis vulnerability does not affect Splunk Enterprise versions below 9.4.9 and 9.3.10 because the Discover Splunk Observability Cloud app does not come with Splunk Enterprise."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0305"}], "title": "Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise", "datePublic": "2026-03-11T00:00:00.000Z", "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.", "cweId": "CWE-200"}]}], "source": {"advisory": "SVD-2026-0305"}, "credits": [{"lang": "en", "value": "Will Zgoda, Splunk"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-11T16:18:17.121Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T15:40:11.819588Z", "id": "CVE-2026-20166", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T16:19:30.880Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20166", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T15:40:11.819588Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T15:40:22.184Z"}}], "cna": {"title": "Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise", "source": {"advisory": "SVD-2026-0305"}, "credits": [{"lang": "en", "value": "Will Zgoda, Splunk"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.2", "lessThan": "10.2.1", "versionType": "custom"}, {"status": "affected", "version": "10.0", "lessThan": "10.0.4", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud Platform", "versions": [{"status": "affected", "version": "10.2.2510", "lessThan": "10.2.2510.5", "versionType": "custom"}, {"status": "affected", "version": "10.1.2507", "lessThan": "10.1.2507.16", "versionType": "custom"}, {"status": "affected", "version": "10.0.2503", "lessThan": "10.0.2503.12", "versionType": "custom"}]}], "datePublic": "2026-03-11T00:00:00.000Z", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0305"}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could retrieve the Observability Cloud API access token through the Discover Splunk Observability Cloud app due to improper access control. \n\nThis vulnerability does not affect Splunk Enterprise versions below 9.4.9 and 9.3.10 because the Discover Splunk Observability Cloud app does not come with Splunk Enterprise.", "supportingMedia": [{"type": "text/html", "value": "In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could retrieve the Observability Cloud API access token through the Discover Splunk Observability Cloud app due to improper access control. \n\nThis vulnerability does not affect Splunk Enterprise versions below 9.4.9 and 9.3.10 because the Discover Splunk Observability Cloud app does not come with Splunk Enterprise.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-200", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-11T16:18:17.121Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20166", "state": "PUBLISHED", "dateUpdated": "2026-03-12T16:19:30.880Z", "dateReserved": "2025-10-08T11:59:15.390Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-11T16:18:17.121Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"lessThan": "10.2.1", "status": "affected", "version": "10.2", "versionType": "custom"}, {"lessThan": "10.0.4", "status": "affected", "version": "10.0", "versionType": "custom"}]}, {"product": "Splunk Cloud Platform", "vendor": "Splunk", "versions": [{"lessThan": "10.2.2510.5", "status": "affected", "version": "10.2.2510", "versionType": "custom"}, {"lessThan": "10.1.2507.16", "status": "affected", "version": "10.1.2507", "versionType": "custom"}, {"lessThan": "10.0.2503.12", "status": "affected", "version": "10.0.2503", "versionType": "custom"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "1E7483F3-FE84-42B9-A2E7-6E89B110BA31", "versionEndExcluding": "10.0.4", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:10.2.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "122C01E6-CD7E-44B3-BC65-2ACEDFE704E5", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA248FBD-6AFF-492C-93A8-17EAA7C07FC1", "versionEndExcluding": "10.0.2503.12", "versionStartIncluding": "10.0.2503", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "17E11C59-CC22-48AA-A969-717D4D527019", "versionEndExcluding": "10.1.2507.16", "versionStartIncluding": "10.1.2507", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "6609708F-A13F-4E4E-9883-C11659BD6C3C", "versionEndExcluding": "10.2.2510.5", "versionStartIncluding": "10.2.2510", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could retrieve the Observability Cloud API access token through the Discover Splunk Observability Cloud app due to improper access control. \n\nThis vulnerability does not affect Splunk Enterprise versions below 9.4.9 and 9.3.10 because the Discover Splunk Observability Cloud app does not come with Splunk Enterprise."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise anteriores a la 10.2.1 y 10.0.4, y en las versiones de Splunk Cloud Platform anteriores a la 10.2.2510.5, 10.1.2507.16 y 10.0.2503.12, un usuario con privilegios bajos que no posee los roles de Splunk 'admin' o 'power' podr\u00eda recuperar el token de acceso de la API de Observability Cloud a trav\u00e9s de la aplicaci\u00f3n Discover Splunk Observability Cloud debido a un control de acceso inadecuado.\n\nEsta vulnerabilidad no afecta a las versiones de Splunk Enterprise anteriores a la 9.4.9 y 9.3.10 porque la aplicaci\u00f3n Discover Splunk Observability Cloud no viene incluida con Splunk Enterprise."}], "id": "CVE-2026-20166", "lastModified": "2026-06-17T10:17:15.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20166", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T15:40:11.819588Z", "version": "2.0.3"}}]}, "published": "2026-03-11T17:16:57.130", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://advisory.splunk.com/advisories/SVD-2026-0305"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "psirt@cisco.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.2.2510,10.2.2510.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.1.2507,10.1.2507.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.2503,10.0.2503.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Splunk Cloud Platform", "source": "cna", "vendor": "Splunk"}, "product": "splunk_cloud_platform", "vendor": "splunk"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.2,10.2.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.0,10.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Splunk Enterprise", "source": "cna", "vendor": "Splunk"}, "product": "splunk_enterprise", "vendor": "splunk"}], "analysis": {"en": {"generated_at": "2026-03-24T21:51:16.504514+00:00", "value": {"mitigation_remediation": ["Upgrade Splunk Enterprise to version 10.2.1 or later, or to 10.0.4 or later.", "Upgrade Splunk Cloud Platform to version 10.2.2510.5, 10.1.2507.16, or 10.0.2503.12.", "Remove or disable the Discover Splunk Observability Cloud app on older instances if an immediate upgrade is not possible.", "Restart Splunk services after applying the upgrade to ensure the new configuration is active."], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Splunk Enterprise versions below 10.2.1 and 10.0.4, as well as Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12. Versions earlier than 9.4.9 for Enterprise and 9.3.10 are not affected because the Discover app is not included with those releases.", "description_and_impact": "A low\u2011privileged user that does not have the \"admin\" or \"power\" Splunk roles can retrieve the Observeability Cloud API access token through the Discover Splunk Observability Cloud app. Improper access control allows this disclosure, which is a classic information\u2011disclosure weakness identified as CWE\u2011200. The exposed token could enable the attacker to make authenticated API calls and potentially access, modify, or exfiltrate data within the Splunk environment.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a moderate severity, and the EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs a low\u2011privileged account with access to the Splunk instance and the Discover app to obtain the token; no administrative privileges or remote code execution are required. This makes the attack relatively easy to execute for authenticated users but still limited in scope compared to higher\u2011privilege exploits."}}}}, "created": "2026-03-12T09:57:58.946175+00:00", "updated": "2026-03-25T11:50:13.439505+00:00", "vendors": ["splunk", "splunk$PRODUCT$splunk_cloud_platform", "splunk$PRODUCT$splunk_enterprise"]}