Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise
Advisory ID: SVD-2025-0704
CVE ID: CVE-2025-20321
Published: 2025-07-07
Last Update: 2025-07-07
CVSSv3.1 Score: 6.5, Medium
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE: CWE-352
Bug ID: VULN-26031
Description
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership state in a Splunk Search Head Cluster (SHC) through a Cross-Site Request Forgery (CSRF), potentially leading to the removal of the captain or a member of the SHC.
The vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser. The attacker should not be able to exploit the vulnerability at will.
Solution
Upgrade Splunk Enterprise to versions 9.4.3, 9.3.5, 9.2.7, 9.1.10, or higher.
Splunk is actively monitoring and patching Splunk Cloud Platform instances.
Product Status
| Product | Base Version | Component | Affected Version | Fix Version |
|---|---|---|---|---|
| Splunk Enterprise | 9.4 | Splunk Web | 9.4.0 to 9.4.2 | 9.4.3 |
| Splunk Enterprise | 9.3 | Splunk Web | 9.3.0 to 9.3.4 | 9.3.5 |
| Splunk Enterprise | 9.2 | Splunk Web | 9.2.0 to 9.2.6 | 9.2.7 |
| Splunk Enterprise | 9.1 | Splunk Web | 9.1.0 to 9.1.9 | 9.1.10 |
| Splunk Enterprise Cloud | 9.3.2411 | Splunk Web | Below 9.3.2411.104 | 9.3.2411.104 |
| Splunk Enterprise Cloud | 9.3.2408 | Splunk Web | Below 9.3.2408.114 | 9.3.2408.114 |
| Splunk Enterprise Cloud | 9.2.2406 | Splunk Web | Below 9.2.2406.119 | 9.2.2406.119 |
Mitigations and Workarounds
The vulnerability affects instances with Splunk Web turned on. You could turn Splunk Web off as a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning Splunk Web off.
Detections
None
Severity
Splunk rates this vulnerability a 6.5, Medium, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
The vulnerability affects instances with Search Head Clustering turned on. If Search Head Clustering is not turned on, then there should be no impact and the severity would be Informational.
Acknowledgments
Anton (therceman)