CVE-2025-20388: SSRF in Splunk Enterprise

This SSRF vulnerability allows a malicious actor with elevated privileges within a Splunk environment to perform internal network reconnaissance. Specifically, an attacker possessing the change_authentication role can add new search peers and, during this process, trigger requests to internal IP addresses and ports. This enables them to map the internal network topology, identify running services, and potentially discover sensitive information residing on internal systems. The blast radius is limited to the internal network accessible from the Splunk search head, but successful exploitation could lead to further compromise if internal systems are vulnerable. While direct data exfiltration isn't possible through this SSRF, it provides a crucial foothold for lateral movement and reconnaissance.

1. Reserved2024-10-10
2. Published2025-12-03
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-20388 is to upgrade Splunk Enterprise or Cloud Platform to a version containing the fix. Upgrade to version 10.1.2507.4 for Splunk Enterprise or the corresponding fixed versions for Cloud Platform (10.1.2507.4, 10.0.2503.7, and 9.3.2411.116). If immediate upgrade is not feasible, restrict the change_authentication capability to only trusted users and carefully review any new search peer configurations. Consider implementing network segmentation to limit the potential impact of internal network scanning. After upgrade, confirm the fix by attempting to add a new search peer and verifying that internal IP/port enumeration is prevented.