Home

Description

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the RSA `accessKey` value from the [<u>Authentication.conf</u> ](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/authentication.conf)file, in plain text.

PUBLISHED Reserved 2025-10-08 | Published 2026-02-18 | Updated 2026-02-18 | Assigner cisco




MEDIUM: 6.8CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Problem types

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Product status

10.0 (custom) before 10.0.2
affected

9.4 (custom) before 9.4.7
affected

9.3 (custom) before 9.3.9
affected

9.2 (custom) before 9.2.11
affected

References

advisory.splunk.com/advisories/SVD-2026-0207

cve.org (CVE-2026-20142)

nvd.nist.gov (CVE-2026-20142)

Download JSON