EUVD-2026-31139
GHSA-7mj7-jqh4-hc7f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the _internal index could view session cookies and response bodies that contain sensitive data.
AnalysisAI
Sensitive information disclosure in Splunk Enterprise (below 10.2.2 and 10.0.5) and Splunk Cloud Platform (multiple branches below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13) allows authenticated users with a role granting access to the _internal index to view session cookies and response bodies containing sensitive data logged by the platform. Cisco-reported and patched by Splunk in advisory SVD-2026-0503, the issue is a CWE-532 sensitive-data-in-logs flaw rather than a remote code execution bug, with no public exploit identified at time of analysis.
Technical ContextAI
Splunk's _internal index stores the platform's own operational logs, including splunkd access logs and other internal telemetry generated by the indexer, search head, and forwarder components covered by the CPEs cpe:2.3:a:splunk:splunk_enterprise and cpe:2.3:a:splunk:splunk_cloud_platform. The underlying weakness is CWE-532 (Insertion of Sensitive Information into Log File): HTTP session cookies and full response bodies - which can contain authentication tokens, search results, or PII - were being written into log events that landed in _internal. Because Splunk's role-based access control treats _internal as a queryable index, any role granted read access to it (including custom roles or broadly-scoped power/admin-adjacent roles) could simply run a search to harvest those sensitive artifacts.
RemediationAI
Vendor-released patches are available: upgrade Splunk Enterprise to 10.2.2 or 10.0.5 (or later on each branch), and confirm Splunk Cloud Platform tenants are running at least 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, or 10.0.2503.13 as appropriate to your release train; Splunk Cloud customers are typically upgraded by Splunk but should verify via the advisory at https://advisory.splunk.com/advisories/SVD-2026-0503. As an immediate compensating control until patching, audit which roles grant read access to the _internal index and revoke that privilege from any role that does not strictly require it (note this will break dashboards, monitoring searches, and Splunk Monitoring Console views that rely on _internal); additionally, rotate any session cookies and credentials that may have been exposed in _internal logs, and consider purging or restricting historical _internal data through retention policy adjustments while accepting the loss of operational forensics for that window.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today