Splunk Enterprise: Exposure of sensitive Duo authentication keys

Summary

Some users with access to a specific Splunk index can view sensitive Duo authentication keys, which could be misused to access accounts. This affects specific versions of Splunk Enterprise. To protect your organization, update to a patched version of Splunk or restrict access to the affected index.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
splunk	splunk	> 9.2.0 , <= 9.2.11	–
splunk	splunk	> 9.3.0 , <= 9.3.9	–
splunk	splunk	> 9.4.0 , <= 9.4.7	–
splunk	splunk	> 10.0.0 , <= 10.0.2	–

Original title

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index co...

Original description

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the `integrationKey`, `secretKey`, and `appSecretKey` secrets, generated by [Duo Two-Factor Authentication for Splunk Enterprise](https://duo.com/docs/splunk), in plain text.

nvd CVSS3.1 4.9

Vulnerability type

CWE-532 Insertion of Sensitive Information into Log File

https://advisory.splunk.com/advisories/SVD-2026-0203 Vendor Advisory