Splunk Enterprise, Cloud Vulnerability Exposes Session Cookies, Sensitive Data

The National Vulnerability Database has disclosed CVE-2026-20239, a high-severity vulnerability (CVSS 7.5) affecting Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13. This flaw, categorized as CWE-532 (Inclusion of Sensitive Data in Log Files), allows a user with access to the _internal index to view session cookies and response bodies containing sensitive information.

This isn’t a trivial information leak. An attacker who has managed to gain low-privileged access to Splunk, specifically a role with _internal index access, can escalate their visibility significantly. The exposure of session cookies is a direct path to session hijacking, granting the attacker the full privileges of the legitimate user. Response bodies often contain critical business data, PII, or even further authentication tokens, making this a prime target for lateral movement and data exfiltration.

The attacker’s calculus here is clear: leverage existing, potentially weak, internal Splunk access to harvest high-value credentials and data. For defenders, this means internal segmentation and least privilege are paramount, even for monitoring tools like Splunk. The _internal index should be treated with extreme care, and access locked down to an absolute minimum of trusted administrators.