CVE-2026-20202
Full vulnerability record from the local CVENow database.
Description
In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.20, 10.0.2503.13, and 9.3.2411.127, a user who holds a role that contains the high-privilege capability `edit_user`could create a specially crafted username that includes a null byte or a non-UTF-8 percent-encoded byte due to improper input validation.<br><br>This could lead to inconsistent conversion of usernames into a proper format for storage and account management inconsistencies, such as being unable to edit or delete affected users.
Severity
MEDIUM
CVSS score
6.6
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-15 16:16:34.120000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-20202",
"sourceIdentifier": "[email protected]",
"published": "2026-04-15T16:16:34.120",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.20, 10.0.2503.13, and 9.3.2411.127, a user who holds a role that contains the high-privilege capability `edit_user`could create a specially crafted username that includes a null byte or a non-UTF-8 percent-encoded byte due to improper input validation.<br><br>This could lead to inconsistent conversion of usernames into a proper format for storage and account management inconsistencies, such as being unable to edit or delete affected users."
},
{
"lang": "es",
"value": "En las versiones de Splunk Enterprise anteriores a 10.2.2, 10.0.5, 9.4.10 y 9.3.11, y las versiones de Splunk Cloud Platform anteriores a 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.20, 10.0.2503.13 y 9.3.2411.127, un usuario con un rol que contiene la capacidad de alto privilegio ’edit_user’ podría crear un nombre de usuario especialmente diseñado que incluye un byte nulo o un byte codificado en porcentaje no UTF-8 debido a una validación de entrada incorrecta.\n\nEsto podría llevar a una conversión inconsistente de los nombres de usuario a un formato adecuado para el almacenamiento y a inconsistencias en la gestión de cuentas, como la imposibilidad de editar o eliminar usuarios afectados."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"versions": [
{
"version": "10.2",
"lessThan": "10.2.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0",
"lessThan": "10.0.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.4",
"lessThan": "9.4.10",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3",
"lessThan": "9.3.11",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Splunk",
"product": "Splunk Cloud Platform",
"versions": [
{
"version": "10.4.2603",
"lessThan": "Not Affected",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.3.2512",
"lessThan": "10.3.2512.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.2.2510",
"lessThan": "10.2.2510.10",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.1.2507",
"lessThan": "10.1.2507.20",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0.2503",
"lessThan": "10.0.2503.13",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3.2411",
"lessThan": "9.3.2411.127",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.7,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-15T00:00:00+00:00",
"id": "CVE-2026-20202",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-176"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.3.0",
"versionEndExcluding": "9.3.11",
"matchCriteriaId": "9A537203-F31B-44A1-BB9E-C62F4539FA0B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.4.0",
"versionEndExcluding": "9.4.10",
"matchCriteriaId": "0205D102-93C7-42FA-A33E-E517BB7760C4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndExcluding": "10.0.5",
"matchCriteriaId": "D5A01879-50A5-4266-A08C-F55584F442ED"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.2.0",
"versionEndExcluding": "10.2.2",
"matchCriteriaId": "9F3A147D-2A67-469A-A223-248DEFB413E0"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.3.2411",
"versionEndExcluding": "9.3.2411.127",
"matchCriteriaId": "6FCB2A3C-8069-4AAC-8746-4B9679DE8116"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.0.2503",
"versionEndExcluding": "10.0.2503.13",
"matchCriteriaId": "D5C098C2-9ED5-41B4-BE57-984B71027144"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.1.2507",
"versionEndExcluding": "10.1.2507.20",
"matchCriteriaId": "9CD48754-5DBD-499A-9004-BD8D948E548A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.2.2510",
"versionEndExcluding": "10.2.2510.10",
"matchCriteriaId": "601A4BEC-6F0D-4A52-8B68-18902574E84C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.3.2512",
"versionEndExcluding": "10.3.2512.6",
"matchCriteriaId": "29253EBC-0E89-46ED-B504-E81F5D4E7E3F"
}
]
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0401",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}