Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• splunk splunkup to 6.5.1 inclusive
• splunk splunk5.0.0 and later · before 5.0.18
• splunk splunk6.0.0 and later · before 6.0.14
• splunk splunk6.1.0 and later · before 6.1.13
• splunk splunk6.2.0 and later · before 6.2.13.1
• splunk splunk6.3.0 and later · before 6.3.10
• splunk splunk6.4.0 and later · before 6.4.6
• splunk splunk6.5.0 and later · before 6.5.3

Other highest-scoring records for the same primary product.

• CVE-2026-20253Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk EnterpriseKEV
  98Now
• CVE-2023-32707‘edit_user’ Capability Privilege Escalation
  59Plan
• CVE-2018-11409Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demon
  50Plan
• CVE-2026-20251Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway
  45Plan
• CVE-2023-32714Path Traversal in Splunk App for Lookup File Editing
  45Plan
• CVE-2022-32158Splunk Enterprise deployment servers allow client publishing of forwarder bundles
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.