Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise

Advisory ID: SVD-2025-0705

CVE ID: CVE-2025-20322

Published: 2025-07-07

Last Update: 2025-07-07

CVSSv3.1 Score: 4.3, Medium

CWE: CWE-352

Bug ID: VULN-26030

Description

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated attacker could send a specially-crafted SPL search command that could trigger a rolling restart in the Search Head Cluster through a Cross-Site Request Forgery (CSRF), potentially leading to a denial of service (DoS).

The vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser. The attacker should not be able to exploit the vulnerability at will.

See How rolling restart works for more information.

Solution

Upgrade Splunk Enterprise to versions 9.4.3, 9.3.5, 9.2.7, 9.1.10, or higher.

Splunk is actively monitoring and patching Splunk Cloud Platform instances.

Product Status

ProductBase VersionComponentAffected VersionFix Version
Splunk Enterprise9.4Splunk Web9.4.0 to 9.4.29.4.3
Splunk Enterprise9.3Splunk Web9.3.0 to 9.3.49.3.5
Splunk Enterprise9.2Splunk Web9.2.0 to 9.2.69.2.7
Splunk Enterprise9.1Splunk Web9.1.0 to 9.1.99.1.10
Splunk Enterprise Cloud9.3.2411Splunk WebBelow 9.3.2411.1049.3.2411.104
Splunk Enterprise Cloud9.3.2408Splunk WebBelow 9.3.2408.1139.3.2408.113
Splunk Enterprise Cloud9.2.2406Splunk WebBelow 9.2.2406.1199.2.2406.119

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. You could turn Splunk Web off as a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning Splunk Web off.

Detections

None

Severity

Splunk rates this vulnerability a 4.3, Medium, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.
The vulnerability affects instances with Search Head Clustering turned on. If Search Head Clustering is not turned on, then there should be no impact and the severity would be Informational.

Acknowledgments

Anton (therceman)