Splunk Enterprise and Cloud Platform
CVE-2025-20321: Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership state in a Splunk Search Head Cluster (SHC) through a Cross-Site Request Forgery (CSRF), potentially leading to the removal of the captain or a member of the SHC.<br><br>The vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Splunk Enterprise 9.4 | 9.4.3 or later |
| Splunk Enterprise 9.3 | 9.3.5 or later |
| Splunk Enterprise 9.2 | 9.2.7 or later |
| Splunk Enterprise 9.1 | 9.1.10 or later |
| Splunk Enterprise Cloud 9.3 | 9.3.2411.104 or later |
| Splunk Enterprise Cloud 9.3 | 9.3.2408.114 or later |
| Splunk Enterprise Cloud 9.2 | 9.2.2406.119 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership state in a Splunk Search Head Cluster (SHC) through a Cross-Site Request Forgery (CSRF), potentially leading to the removal of the captain or a member of the SHC.<br><br>The vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser. The attacker should not be able to exploit the vulnerability at will.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.