Vulnerability · Published Feb 18, 2026 · Assigned by cisco
CVE-2026-20138Sensitive Information Disclosure in "_internal" index in Splunk Enterprise
Medium 6.8
In plain English
A medium-severity sensitive data in logs in Splunk Enterprise from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Official description
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the `integrationKey`, `secretKey`, and `appSecretKey` secrets, generated by [Duo Two-Factor Authentication for Splunk Enterprise](https://duo.com/docs/splunk), in plain text.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.0 – before 10.0.29.4 – before 9.4.79.3 – before 9.3.99.2 – before 9.2.11 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H