CVE-2026-20137

In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122, a low-privileged user who does not hold the "admin" or "power" Splunk roles could bypass the SPL safeguards for risky commands when they create a Data Model that contains an injected SPL query within an object. They can bypass the safeguards by exploiting a path traversal vulnerability.

• splunk splunk (>= 9.2.0 < 9.2.9) • splunk splunk (>= 9.3.0 < 9.3.7) • splunk splunk (>= 9.4.0 < 9.4.5) • splunk splunk (>= 10.0.0 < 10.0.3) • splunk splunk cloud platform (>= 9.3.2408 < 9.3.2408.122) • splunk splunk cloud platform (>= 9.3.2411 < 9.3.2411.112) • splunk splunk cloud platform (>= 10.0.2503 < 10.0.2503.9) • splunk splunk cloud platform 10.1.2507