Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

Advisory ID: SVD-2026-0601

CVE ID: CVE-2026-20251

Published: 2026-06-10

Last Update: 2026-06-10

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Bug ID: VULN-69217

Description

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.

The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

See App Key Value Store and About role-based user access in the Splunk documentation for more information.

Solution

Upgrade Splunk Enterprise to versions 10.4.0, 10.2.4, 10.0.7, 9.4.12, and 9.3.13, or higher.

Splunk is actively monitoring and patching Splunk Cloud Platform instances.

Product Status

ProductBase VersionComponentAffected VersionFix Version
Splunk Enterprise10.4Splunk Secure GatewayNot affectedN/A
Splunk Enterprise10.2Splunk Secure Gateway10.2.0 to 10.2.310.2.4
Splunk Enterprise10.0Splunk Secure Gateway10.0.0 to 10.0.610.0.7
Splunk Enterprise9.4Splunk Secure Gateway9.4.0 to 9.4.119.4.12
Splunk Enterprise9.3Splunk Secure Gateway9.3.0 to 9.3.129.3.13
Splunk Cloud Platform10.3.2512Splunk Secure GatewayBelow 10.3.2512.1210.3.2512.12
Splunk Cloud Platform10.2.2510Splunk Secure GatewayBelow 10.2.2510.1410.2.2510.14
Splunk Cloud Platform10.1.2507Splunk Secure GatewayBelow 10.1.2507.2210.1.2507.22
Splunk Cloud Platform9.3.2411Splunk Secure GatewayBelow 9.3.2411.1329.3.2411.132
Splunk Secure Gateway3.10Below 3.10.63.10.6
Splunk Secure Gateway3.9Below 3.9.203.9.20
Splunk Secure Gateway3.8Below 3.8.673.8.67

Mitigations and Workarounds

Turn off or remove the Splunk Secure Gateway app. See Manage app and add-on objects in the Splunk documentation.

Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

Detections

None

Severity

Splunk rates this vulnerability an 8.8, High, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

If you remove or turn off the Splunk Secure Gateway app, there should be no impact and the severity would be Informational.

Acknowledgments

M Mahdan Argya Syarif (0xbeludan)