VDB
CVE-2026-20164
CVE-2026-20164
PUBLISHED
CVSS 6.5 MEDIUM
In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, and 9.3.2411.123, a low-privileged user that does not hold the "admin" or "power" Splunk roles could access the `/splunkd/__raw/servicesNS/-/-/configs/conf-passwords` REST API endpoint, which exposes the hashed or plaintext password values that are stored in the passwords.conf configuration file due to improper access control. This vulnerability could allow for the unauthorized disclosure of sensitive credentials.
EPSS 0.05% · 15.4th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.05%
15.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.0, 10.0, 9.4 |
| splunk | splunk | 9.3.0, 9.4.0, 10.0.0 |
| Splunk | Splunk Cloud Platform | 10.0.2503, 10.2.2510, 10.1.2507 |
| splunk | splunk_cloud_platform | 9.3.2411, 10.0.2503, 10.1.2507 |
Exploit Intelligence
- https://advisory.splunk.com/advisories/SVD-2026-0303 (circl)
- traffic_cve_webshell.yar (github-yara)
- traffic_cve_webshell.yar (github-yara)
- traffic_cve_webshell.yar (github-yara)
- traffic_cve_webshell.yar (github-yara)
Timeline
- Mar 11, 2026 CVE Published
- Mar 12, 2026 EPSS Score
- Mar 12, 2026 CVE Updated
- Mar 13, 2026 EPSS Score
- Mar 14, 2026 EPSS Score
- Mar 15, 2026 EPSS Score
- Mar 16, 2026 EPSS Score
- Mar 17, 2026 EPSS Score
- Mar 18, 2026 EPSS Score
- Mar 19, 2026 EPSS Score
- Mar 20, 2026 EPSS Score
- Mar 21, 2026 EPSS Score
References
- https://advisory.splunk.com/advisories/SVD-2026-0303 url
- https://nvd.nist.gov/vuln/detail/CVE-2026-20164 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0302 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0311 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0308 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0309 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0305 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0310 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0304 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0301 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0313 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0306 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0307 advisory
- https://advisory.splunk.com/advisories/SVD-2026-0312 advisory