CVE-2026-20166: splunk
Vulnerability summary
CVE-2026-20166 is a medium (CVSS 5.4) vulnerability in splunk. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.7% of scored vulnerabilities.
Timeline
- 11-03-2026PublishedVulnerability first disclosed.
- 12-03-2026Last modifiedVulnerability information updated.
Description
In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve the Observability Cloud API access token through the Discover Splunk Observability Cloud app due to improper access control. This vulnerability does not affect Splunk Enterprise versions below 9.4.9 and 9.3.10 because the Discover Splunk Observability Cloud app does not come with Splunk Enterprise.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
+0.01 pp
From 0.15% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Splunk3 products
- splunk≥ 10.0.0, < 10.0.4 | 10.2.0
- splunk_cloud_platform≥ 10.0.2503, < 10.0.2503.12 | ≥ 10.1.2507, < 10.1.2507.16 | ≥ 10.2.2510, < 10.2.2510.5
- splunk enterprise≥ 10.2, < 10.2.1 | ≥ 10.0, < 10.0.4
1 vendor · 3 products
References
1 links- advisory.splunk.com/advisories/SVD-2026-0305Vendor Advisory