Splunk Secure Gateway RCE Vulnerability Discovered

A high-severity vulnerability, CVE-2026-20251, has been identified in Splunk Secure Gateway (SSG), potentially allowing authenticated users with low-level privileges to execute arbitrary code on affected systems. The flaw carries a CVSS score of 8.8 and poses a significant risk to organizations using Splunk Secure Gateway in enterprise environments.

According to security researchers, the vulnerability is caused by unsafe deserialization of user-controlled data, allowing specially crafted input to be executed on the server.

How the Vulnerability Works

The issue exists in the way Splunk Secure Gateway processes alert data stored in its KV Store. A low-privileged authenticated user can submit a specially crafted JSON payload through the Splunk REST API.

Due to weaknesses in the application’s validation process, the malicious data is accepted as legitimate and passed to the deserialization component. This enables attackers to execute arbitrary Python code with the privileges of the Splunk service account.

Researchers found that the validation logic fails to inspect all fields within the submitted JSON document. As a result, attackers can bypass security checks by embedding malicious content inside otherwise valid data structures.

A successful attack requires only a valid low-privileged Splunk account and does not rely on user interaction, making the vulnerability particularly dangerous in shared enterprise environments.

Below is a simplified proof-of-concept (PoC) demonstrating how the vulnerability can be exploited using a benign command:

import jsonpickle

import subprocess

payload = {

“py/object”: “spacebridgeapp.data.alert_data.Alert”,

“notification”:

“py/reduce”:

[

{“py/function”: “subprocess.check_output”},

{“py/tuple”: [[“uname”, “-a”]]}

]

}

encoded = jsonpickle.encode(payload)

decoded = jsonpickle.decode(encoded, safe=True)

print(decoded)

subprocess.check_output(["uname", "-a"]) command during data deserialization. This confirms that enabling the safe=True option in jsonpickle does not fully prevent exploitation.

The flaw affects Splunk Secure Gateway versions 3.8.x, 3.9.x, and 3.10.x, along with Splunk Enterprise versions released before 10.0.7, 10.2.4, and 10.4.0. Splunk has fixed the issue in Secure Gateway versions 3.8.67, 3.9.20, and 3.10.6.

Security Recommendations

To reduce the risk of exploitation, organizations should:

Apply the latest Splunk Secure Gateway security patches immediately.
Upgrade to the fixed versions: SSG 3.8.67, 3.9.20, or 3.10.6, and supported Splunk Enterprise releases.
Disable the Secure Gateway app if it is not actively being used.
Restrict KV Store write permissions to trusted administrators only.
Enforce the principle of least privilege by limiting access to authorized users.
Avoid deserializing untrusted data with jsonpickle or similar libraries without proper validation.
Implement input validation and class allow-listing to prevent unsafe deserialization.
Monitor Splunk logs for unusual activity or unauthorized changes to the KV Store.

Following these best practices can help organizations reduce the risk of remote code execution and strengthen the overall security of their Splunk environment.