Third-Party Package Updates in Splunk Enterprise - March 2026
Advisory ID: SVD-2026-0306
CVE ID: Multiple
Published: 2026-03-11
Last Update: 2026-03-11
Description
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.2.1, 10.0.4, 9.4.9, 9.3.10, and higher.
| Package | Remediation | CVE | Severity |
|---|---|---|---|
| golang/x/oauth21 | Upgraded golang/x/oauth2 in `opamp-svc` sidecar binary to version 0.27.0 | CVE-2025-22868 | High |
| requests2 | Upgraded requests to version 2.32.5 | CVE-2024-47081 | Medium |
| golang3 | Upgraded golang to Go compiler in `splunksup` binary to version go1.24.11 | Multiple | High |
| golang.org/x/crypto4 | Upgraded golang crypto in `splunksup` binary to version 0.45.0 | Multiple | High |
| golang.org/x/net5 | Upgraded golang net in `splunksup` binary to version 0.47.0 | Multiple | High |
| golang6 | Upgraded golang in `identity` binary to Go compiler version go1.24.11 | Multiple | High |
| golang.org/x/crypto7 | Upgraded golang crypto in `identity` binary to version 0.45.0 | Multiple | High |
| golang.org/x/net8 | Upgraded golang net in `identity` binary to version 0.47.0 | Multiple | High |
| golang.org/grpc9 | Upgraded golang grpc in `identity` binary to version 1.74.2 | CVE-2024-7246 | Medium |
| github.com/golang-jwt/jwt/v410 | Upgraded golang-jwt in `identity` binary to version 4.5.2 | Multiple | High |
| golang11 | Upgraded golang in `splunk-edge` binary to Go compiler version go1.24.11 | Multiple | High |
| golang.org/x/crypto12 | Upgraded golang crypto in `splunk-edge`binary to version 0.45.0 | Multiple | High |
| golang.org/x/net13 | Upgraded golang net in `splunk-edge`binary to version 0.47.0 | Multiple | High |
| cloudflare/circl14 | Upgraded cloudflare/circl in `splunk-edge`binary to version 1.6.1 | CVE-2025-8556 | Low |
| kin-openapi15 | Upgraded kin-openapi to version 0.131.0 | CVE-2025-30153 | High |
| golang-jwt16 | Upgraded golang-jwt to verion 5.2.2 | CVE-2025-30204 | High |
| protobuf17 | Upgraded protobuf to version 4.25.8 | CVE-2025-4565 | High |
| aiohttp18 | Upgraded aiohttp to version 3.13.3 | Multiple | High |
| azure-core19 | Upgraded azure-core to version 1.38.0 | Multiple | High |
1 Upgraded golang to version 0.27.0 at $SPLUNK_HOME/opt/packages/opamp-svcto remedy CVE-2025-22868 in Splunk Enterprise version 10.0.4. Splunk Enterprise version 10.2.x use version 0.30.0. The opamp-svc sidecar binary is not present in Splunk Enterprise versions 9.4.x and 9.3.x.
2 Upgraded requests to version 2.32.5 to remedy CVE-2024-47081 in Splunk Enterprise at $SPLUNK_HOME/lib/python3.7/site-packages/requests-2.31.0.dist-info/METADATA.
3 Upgraded golang in splunksup binary to Go compiler version go1.24.11 to remedy CVE-2025-0913, CVE-2025-22871, CVE-2025-22874, CVE-2025-4673, CVE-2025-47906, CVE-2025-47907, CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725 at $SPLUNK_HOME/etc/apps/splunk_pipeline_builders/binaries/splunksup/ in Splunk Enterprise versions 10.0.4 and 10.2.1. Splunksup binary is not present in Splunk Enterprise versions 9.4.x and 9.3.x.
4 Upgraded golang crypto in splunksup binary to version 0.45.0 to remedy CVE-2025-47913, CVE-2025-47914, CVE-2025-58181 at $SPLUNK_HOME/etc/apps/splunk_pipeline_builders/binaries/splunksup/in Splunk Enterprise versions 10.0.4 and 10.2.1. Splunksup binary is not present in Splunk Enterprise versions 9.4.x and 9.3.x.
5 Upgraded golang net in splunksup binary to version 0.47.0 to remedy CVE-2025-22870 and CVE-2025-22872 at $SPLUNK_HOME/etc/apps/splunk_pipeline_builders/binaries/splunksup/ in Splunk Enterprise versions 10.0.4 and 10.2.1. Splunksup binary is not present in Splunk Enterprise versions 9.4.x and 9.3.x.
6 Upgraded golang in identity binary to Go compiler version go1.24.11 to remedy CVE-2025-0913, CVE-2025-22871, CVE-2025-22874, CVE-2025-4673, CVE-2025-47906, CVE-2025-47907, CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725 at $SPLUNK_HOME/opt/packages/identity.
7 Upgraded golang crypto in identity binary to version 0.45.0 to remedy CVE-2025-47913, CVE-2025-47914, CVE-2025-58181 at $SPLUNK_HOME/opt/packages/identity.
8 Upgraded golang net in identity binary to version 0.47.0 to remedy CVE-2025-22870 and CVE-2025-22872 at $SPLUNK_HOME/opt/packages/identity.
9 Upgraded golang grpc-go in identity binary to version 1.74.2 to remedy CVE-2024-7246 at $SPLUNK_HOME/opt/packages/identity.
10 Upgraded golang-jwt in identity binary to version 4.5.2 to remedy CVE-2024-51744 and CVE-2025-30204 at $SPLUNK_HOME/opt/packages/identity.
11 Upgraded golang in splunk-edge binary to Go compiler version go1.24.11 to remedy CVE-2025-0913, CVE-2025-22871, CVE-2025-22874, CVE-2025-4673, CVE-2025-47906, CVE-2025-47907, CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725 at $SPLUNK_HOME/etc/apps/splunk_pipeline_builders/binaries/splunk-edge/in Splunk Enterprise versions 10.0.4 and 10.2.1. The splunk-edge binary is not present in Splunk Enterprise versions 9.4.x and 9.3.x.
12 Upgraded golang crypto in splunk-edgebinary to version 0.45.0 to remedy CVE-2025-47913, CVE-2025-47914, $SPLUNK_HOME/etc/apps/splunk_pipeline_builders/binaries/splunk-edge/in Splunk Enterprise versions 10.0.4 and 10.2.1. The splunk-edgebinary is not present in Splunk Enterprise versions 9.4.x and 9.3.x.
13 Upgraded golang net in splunk-edgebinary to version 0.47.0 to remedy CVE-2025-22870 and CVE-2025-22872 at $SPLUNK_HOME/etc/apps/splunk_pipeline_builders/binaries/splunk-edge/in Splunk Enterprise versions 10.0.4 and 10.2.1. The splunk-edgebinary is not present in Splunk Enterprise versions 9.4.x and 9.3.x.
14 Upgraded cloudflare/circl in splunk-edgebinary to version 1.6.1 to remedy CVE-2025-8556 at $SPLUNK_HOME/etc/apps/splunk_pipeline_builders/binaries/splunk-edge/ in Splunk Enterprise versions 10.0.4 and 10.2.1. The splunk-edgebinary is not present in Splunk Enterprise versions 9.4.x and 9.3.x.
15 Upgraded kin-openai to version 0.131.0 to remedy CVE-2025-30153 at $SPLUNK_HOME/opt/packages/cmp-orchestratorin Splunk Enterprise version 10.0.4. Splunk Enterprise version 10.2.x is not affected. cmp-orchestrator is not present in Splunk Enterprise versions 9.4.x and 9.3.x
16 Upgraded golang-jwt to version 5.2.2 to remedy CVE-2025-30204 at $SPLUNK_HOME/opt/packages/cmp-orchestrator in Splunk Enterprise version 10.0.4 and 10.2.1. cmp-orchestrator is not present in Splunk Enterprise versions 9.4.x and 9.3.x
17 Upgraded protobuf to version 4.25.8 to remedy CVE-2025-4565 at $SPLUNK_HOME/lib/python3.9/site-packagesin Splunk Enterprise version 10.0.4. Splunk Enterprise version 10.2.x is not affected. Protobuf is not present in Splunk Enterprise version 9.4.x and 9.3.x
18 Upgraded aiohttp to version 3.13.3 in Splunk Secure Gateway app to remedy CVE-2025-69224,CVE-2025-69225,CVE-2025-69230,CVE-2025-69223,CVE-2025-69228,CVE-2025-69227,CVE-2025-69229,CVE-2025-69226. Fixed in Splunk Enterprise versions 10.0.4, 9.4.9, and 9.3.10, and Splunk Secure Gateway app versions 3.10.2, 3.9.16, and 3.8.63
19 Upgraded azure-core to version 1.38.0 in Splunk Enterprise to remedy CVE-2026-21226
Solution
Upgrade Splunk Enterprise to versions 10.2.1, 10.0.4, 9.4.9, 9.3.10, or higher.
Product Status
| Product | Base Version | Affected Version | Fix Version |
|---|---|---|---|
| Splunk Enterprise | 10.2 | Below 10.2.1 | 10.2.1 |
| Splunk Enterprise | 10.0 | 10.0.0 to 10.0.3 | 10.0.4 |
| Splunk Enterprise | 9.4 | 9.4.0 to 9.4.8 | 9.4.9 |
| Splunk Enterprise | 9.3 | 9.3.0 to 9.3.9 | 9.3.10 |
Severity
For the CVEs in this list, Splunk adopted the vendor’s severity rating or the National Vulnerability Database (NVD) common vulnerability scoring system (CVSS) rating, as available.