VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026

CVE-2026-20166

CVE-2026-20166

Description

In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve the Observability Cloud API access token through the Discover Splunk Observability Cloud app due to improper access control.

This vulnerability does not affect Splunk Enterprise versions below 9.4.9 and 9.3.10 because the Discover Splunk Observability Cloud app does not come with Splunk Enterprise.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Splunk/Splunk Enterprisecpe-rescue2 versions
    10.2+ 1 more
    • (no CPE)range: 10.2
    • (no CPE)range: <10.2.1, <10.0.4, <9.4.9, <9.3.10
  • Splunk/Splunk Cloud Platformcpe-rescue2 versions
    10.2.2510+ 1 more
    • (no CPE)range: 10.2.2510
    • cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*range: >=10.0.2503,<10.0.2503.12
  • Splunk/Splunk2 versions
    cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*+ 1 more
    • cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*range: >=10.0.0,<10.0.4
    • cpe:2.3:a:splunk:splunk:10.2.0:*:*:*:enterprise:*:*:*

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.