CVE-2026-20251: Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

Synopsis

Unsafe deserialization of untrusted data in Splunk Secure Gateway allows a low-privileged authenticated user to execute arbitrary code on affected Splunk Enterprise and Splunk Cloud Platform instances. The vulnerability is reachable over the network and requires only a valid low-privilege account, with no additional user interaction needed. Successful exploitation gives the attacker full control over the host, including the ability to read, modify, or destroy data and disrupt service. Patched-image rebuilds at the fixed versions are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Splunk Secure Gateway HTTP endpoint over the network; the service must be accessible from the attacker's position.

• AuthenticationRequired

  A valid Splunk account is needed, but any low-privilege account is sufficient; the attacker does not need admin or power-user rights.

• Victim interactionNot required

  No action by another user is needed; the attacker triggers the deserialization directly by sending a crafted request.

• Attack complexityDetail

  Exploit complexity is low: no race conditions or special environmental factors are required, and a crafted JSON payload reliably triggers unsafe deserialization via the jsonpickle library.

Blast Radius

• The attacker achieves remote code execution and gains the ability to run arbitrary operating system commands on the host running Splunk.
• All data indexed in Splunk, including logs, events, and KV Store contents, becomes readable by the attacker, exposing potentially sensitive operational and security telemetry.
• The attacker can modify or delete indexed data, KV Store records, and Splunk configuration, corrupting the integrity of the monitoring environment.
• The attacker can crash or destabilize the Splunk service, disrupting log ingestion and alerting pipelines that depend on it.