A Cross-Site Request Forgery (CSRF) vulnerability, identified as CVE-2026-20296, in Splunk Enterprise and Splunk Cloud Platform allows an attacker to trick a user with the `list_deployment_server` capability into executing arbitrary Search Processing Language (SPL) searches as the highly privileged `splunk-system-user`, potentially leading to unauthorized access of stored credentials and indexed data due to a lack of CSRF token validation and improper input neutralization.
Splunk Enterprise < 9.4.13 +14
splunk
vulnerability
csrf
remote-code-execution
credential-access
data-exfiltration
web-vulnerability
4t
3c
updated