CVE-2026-20298

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could view stored credential hashes when they access the `/servicesNS/-/-/storage/passwords` REST endpoint through the `|rest` Search Processing Language (SPL) command.<br><br>The exposure happens because the `|rest` SPL command returns the `encr_password` field in the results of the `/servicesNS/-/-/storage/passwords` REST endpoint.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Splunk	Splunk Enterprise	>= 10.4, < 10.4.1; >= 10.2, < 10.2.5; >= 10.0, < 10.0.8; >= 9.4, < 9.4.13
Splunk	Splunk Cloud Platform	>= 10.5.2605, < 10.5.2605.0; >= 10.4.2604, < 10.4.2604.6; >= 10.3.2512, < 10.3.2512.15; >= 10.2.2510, < 10.2.2510.18; >= 10.1.2507, < 10.1.2507.24

References

https://advisory.splunk.com/advisories/SVD-2026-0704Vendor Advisory

Timeline

Published: Jul 15, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-20306.4The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[lvca_carousel]` and CVE-2026-203007.1A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploi CVE-2026-203018.6A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software CVE-2026-203026.1A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an CVE-2026-203039.9As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a CVE-2026-203049.9As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a CVE-2026-203059.1A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection CVE-2026-203069.1A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks CVE-2026-203079.9A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary comman CVE-2026-203084.3A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privil CVE-2026-203096.1A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke CVE-2026-203110.0An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allo