CVE-2026-20202

The record

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.20, 10.0.2503.13, and 9.3.2411.127, a user who holds a role that contains the high-privilege capability `edit_user`could create a specially crafted username that includes a null byte or a non-UTF-8 percent-encoded byte due to improper input validation.<br><br>This could lead to inconsistent conversion of usernames into a proper format for storage and account management inconsistencies, such as being unable to edit or delete affected users.

Affected packages

Related vulnerabilities

• CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by… CWE-176
• CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars()… CWE-176
• CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-176
• CVE-2026-14978 HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass… CWE-176
• CVE-2026-59890 setuptools is a package that allows users to download, build, install, upgrade, and… CWE-176
• CVE-2026-48618 A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling… CWE-176
• CVE-2026-49401 Deno is a JavaScript, TypeScript, and WebAssembly runtime. CWE-176
• CVE-2026-45135 Caddy is an extensible server platform that uses TLS by default. CWE-176