Splunk Enterprise and Cloud Platform
CVE-2023-22936: Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Splunk Enterprise 8.1 | 8.1.13 or later |
| Splunk Enterprise 8.2 | 8.2.10 or later |
| Splunk Enterprise 9.0 | 9.0.4 or later |
| Splunk Cloud Platform - | 9.0.2209.3 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within the environment.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.