Vulnerability · Published Feb 18, 2026 · Assigned by cisco
CVE-2026-20144Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise
Medium 6.8
In plain English
A medium-severity sensitive data in logs in Splunk Cloud Platform from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Official description
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the the Splunk _internal index could view the Security Assertion Markup Language (SAML) configurations for Attribute query requests (AQRs) or Authentication extensions in plain text within the conf.log file, depending on which feature is configured.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.0 – before 10.0.29.4 – before 9.4.79.3 – before 9.3.89.2 – before 9.2.11 |
| Splunk | Splunk Cloud Platform | 10.1.2507 – before 10.1.2507.1110.0.2503 – before 10.0.2503.99.3.2411 – before 9.3.2411.120 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H