CVE-2026-20252: Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise

Synopsis

Server-Side Request Forgery (SSRF) affects Splunk Enterprise and Splunk Cloud Platform through the Dashboard Studio PDF export feature. The vulnerability is reachable over the network by any authenticated low-privilege user, with no victim interaction required. Successful exploitation lets the attacker send HTTP requests from the Splunk server to arbitrary internal destinations, potentially exposing internal services, leaking sensitive data, or tampering with internal endpoints. Patched-image rebuilds at versions 9.3.13, 9.3.2411.132, 9.4.12, 10.0.7, and 10.1.2507.22 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Splunk Dashboard Studio PDF export endpoint over the network; the service must be accessible from the attacker's network position.

• AuthenticationRequired

  Any low-privilege Splunk account is sufficient; the attacker does not need an admin or power role, but must hold valid credentials.

• Victim interactionNot required

  No victim action is needed; the attacker submits a crafted export request directly without involving another user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; bypassing the prefix-based allowlist with an attacker-controlled subdomain (e.g., docs.splunk.com.evil.com) requires no special timing or environmental factors.

Blast Radius

• Reads responses from internal HTTP services reachable by the Splunk server, including metadata APIs, internal dashboards, or credential stores exposed on the internal network.
• Triggers unintended HTTP requests against internal endpoints, which can modify state or consume resources on services that trust requests from the Splunk host.
• Leaks internal network topology by probing hosts and ports that are otherwise unreachable from outside the perimeter.
• Causes limited disruption to the Splunk server's availability through repeated redirect-following requests that consume PDF export service resources.