Introduction
An unauthenticated attacker can use a blind server-side request forgery flaw in Splunk Enterprise to make internal REST API calls as a high-privileged user. In a widely deployed SIEM and analytics platform, that can mean access to sensitive internal resources and disrupted security monitoring.
Splunk is a dominant vendor in the SIEM and operational intelligence market, with thousands of enterprise and government customers worldwide. Organizations across many industries rely on its products for log management, security analytics, and compliance monitoring.
Technical information
CVE-2025-20371 is a blind server-side request forgery vulnerability in specific versions of Splunk Enterprise and Splunk Cloud Platform. It lets an unauthenticated attacker trigger HTTP requests from the Splunk server to arbitrary destinations. When Splunk processes certain REST API calls, it does not properly validate or restrict user-supplied URLs or parameters. Attackers can therefore craft requests that the server executes with the privileges of an authenticated high-privileged user.
Because the SSRF is blind, the attacker does not directly see the response to the forged request. They can still reach internal services, which may let them access sensitive endpoints or use the server's network position for further attacks. The vulnerability is classified under CWE-918 (Server-Side Request Forgery).
No public code snippets or proof-of-concept details are available at this time.
Affected systems and versions
- Splunk Enterprise versions below 10.0.1
- Splunk Enterprise versions below 9.4.4
- Splunk Enterprise versions below 9.3.6
- Splunk Enterprise versions below 9.2.8
- Splunk Cloud Platform versions below 9.3.2411.109
- Splunk Cloud Platform versions below 9.3.2408.119
- Splunk Cloud Platform versions below 9.2.2406.122
Any deployment running these versions or earlier is vulnerable. Both default and custom configurations are affected unless patched.
Vendor security history
Splunk has fixed similar SSRF vulnerabilities before, most notably CVE-2023-22936, which affected authenticated users and required specific search parameters. The company runs a formal vulnerability disclosure program and typically publishes coordinated advisories with detailed remediation steps. Its patch response time is in line with industry standards, and it regularly updates third-party components to address supply chain risks.
