Splunk Enterprise CVE-2026-20252

The attacker must have valid authenticated credentials for the Splunk instance (any role that can use Dashboard Studio is sufficient - the 'admin' and 'power' roles are explicitly NOT required), and the target deployment must have the Dashboard Studio PDF export feature enabled and reachable. Exploitation specifically abuses two implementation behaviors that are present by default in vulnerable versions: the trusted-domain allowlist uses a prefix match (bypassable with attacker-controlled subdomains such as 'docs.splunk.com.evil.com'), and the PDF export service follows HTTP redirects without re-validating each hop against the allowlist - so either primitive alone is enough to coerce the request. Limiting factors: PR:L authentication is required (this is not pre-auth), the PDF export feature must not be disabled, and the value of an attacker's reachable internal targets depends on what the Splunk export service can actually reach on the host network (cloud metadata IMDS, internal admin services, etc.); no user interaction by a victim is needed (UI:N).

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L yields 7.6 (High), reflecting network reach, low complexity, no user interaction, and high confidentiality impact - typical for SSRF that can reach cloud metadata or internal admin APIs. PR:L is important: exploitation requires an authenticated Splunk account, though the description explicitly states an attacker need not hold the 'admin' or 'power' roles, so any low-privileged dashboard user qualifies, which is a low bar in most Splunk deployments. There is no CISA KEV listing, no public POC noted, and no EPSS score supplied, so real-world exploitation pressure is currently unquantified; the vulnerability is realistically a credentialed insider/compromised-account escalation primitive rather than an internet-facing zero-click risk. SSVC signals are not provided in the input. Note the scope is S:U despite SSRF - operators should still treat reachable internal services (cloud IMDS, internal admin endpoints) as the real impact surface, since C:H combined with redirect bypass is well suited to exfiltrating cloud credentials.

An attacker phishes or otherwise obtains credentials for any low-privileged Splunk user (not admin or power). They craft a Dashboard Studio dashboard whose PDF export pulls a resource from a hostname like 'docs.splunk.com.attacker.tld' - which passes the prefix-match check - and which responds with a 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/, causing the export service to fetch cloud instance metadata and expose the rendered response (or its side effects) back to the attacker.