Splunk Enterprise and Cloud Platform
CVE-2024-23675: Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion
In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Splunk Enterprise 9.0 | 9.0.8 or later |
| Splunk Enterprise 9.1 | 9.1.3 or later |
| Splunk Cloud - | 9.1.2312.100 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.