81 lines
4.1 KiB
Markdown
81 lines
4.1 KiB
Markdown
---
|
||
source_url: "https://advisory.splunk.com/advisories/SVD-2026-0601"
|
||
ingested: 2026-06-30
|
||
sha256: fe3466546821450702237ad1014a0bb6bbba2647fcba18d6004aba84d0fc17aa
|
||
discovered_from:
|
||
platform: discord
|
||
channel_id: "1477793137064935675"
|
||
channel_name: "tw"
|
||
message_id: "1521475788287774723"
|
||
author_id: "1477793167486226708"
|
||
posted_at: "2026-06-30T11:21:35.581000000Z"
|
||
message_excerpt: "#tw digest mentioned Splunk Secure Gateway RCE as part of security-operations context."
|
||
score: 2
|
||
---
|
||
**Advisory ID:** SVD-2026-0601
|
||
|
||
**CVE ID:** [CVE-2026-20251](https://www.cve.org/CVERecord?id=CVE-2026-20251)
|
||
|
||
**Published:** 2026-06-10
|
||
|
||
**Last Update:** 2026-06-10
|
||
|
||
**CVSSv3.1 Score:** 8.8, High
|
||
|
||
**CVSSv3.1 Vector:** [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
|
||
|
||
**CWE:** [CWE-502](https://cwe.mitre.org/data/definitions/502.html)
|
||
|
||
**Bug ID:** VULN-69217
|
||
|
||
## Description
|
||
|
||
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.
|
||
|
||
The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.
|
||
|
||
See [App Key Value Store](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-the-app-key-value-store/about-the-app-key-value-store) and [About role-based user access](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation for more information.
|
||
|
||
## Solution
|
||
|
||
Upgrade Splunk Enterprise to versions 10.4.0, 10.2.4, 10.0.7, 9.4.12, and 9.3.13, or higher.
|
||
|
||
Splunk is actively monitoring and patching Splunk Cloud Platform instances.
|
||
|
||
## Product Status
|
||
|
||
| Product | Base Version | Component | Affected Version | Fix Version |
|
||
| --- | --- | --- | --- | --- |
|
||
| Splunk Enterprise | 10.4 | Splunk Secure Gateway | Not affected | N/A |
|
||
| Splunk Enterprise | 10.2 | Splunk Secure Gateway | 10.2.0 to 10.2.3 | 10.2.4 |
|
||
| Splunk Enterprise | 10.0 | Splunk Secure Gateway | 10.0.0 to 10.0.6 | 10.0.7 |
|
||
| Splunk Enterprise | 9.4 | Splunk Secure Gateway | 9.4.0 to 9.4.11 | 9.4.12 |
|
||
| Splunk Enterprise | 9.3 | Splunk Secure Gateway | 9.3.0 to 9.3.12 | 9.3.13 |
|
||
| Splunk Cloud Platform | 10.3.2512 | Splunk Secure Gateway | Below 10.3.2512.12 | 10.3.2512.12 |
|
||
| Splunk Cloud Platform | 10.2.2510 | Splunk Secure Gateway | Below 10.2.2510.14 | 10.2.2510.14 |
|
||
| Splunk Cloud Platform | 10.1.2507 | Splunk Secure Gateway | Below 10.1.2507.22 | 10.1.2507.22 |
|
||
| Splunk Cloud Platform | 9.3.2411 | Splunk Secure Gateway | Below 9.3.2411.132 | 9.3.2411.132 |
|
||
| Splunk Secure Gateway | 3.10 | | Below 3.10.6 | 3.10.6 |
|
||
| Splunk Secure Gateway | 3.9 | | Below 3.9.20 | 3.9.20 |
|
||
| Splunk Secure Gateway | 3.8 | | Below 3.8.67 | 3.8.67 |
|
||
|
||
## Mitigations and Workarounds
|
||
|
||
Turn off or remove the Splunk Secure Gateway app. See [Manage app and add-on objects](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/meet-splunk-apps/manage-app-and-add-on-objects) in the Splunk documentation.
|
||
|
||
Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.
|
||
|
||
## Detections
|
||
|
||
None
|
||
|
||
## Severity
|
||
|
||
Splunk rates this vulnerability an 8.8, High, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
|
||
|
||
If you remove or turn off the Splunk Secure Gateway app, there should be no impact and the severity would be Informational.
|
||
|
||
## Acknowledgments
|
||
|
||
M Mahdan Argya Syarif (0xbeludan)
|