Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored for the app. With this access, the user could view all relevant data available to that token and make limited changes to Splunk Observability Cloud content. The vulnerability does not affect Splunk Enterprise 9.4 and 9.3 versions. The vulnerability is possible because the app's Representational State Transfer (REST) API endpoint handlers do not enforce the read_o11y_content capability before forwarding requests with the stored access token. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T22:17:12.850Z",
  "pubdate": "2026-08-19T22:17:12.850Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the Splunk App for Splunk Observability Cloud running on Splunk Enterprise. The flaw stems from insufficient privilege validation within the application's Representational State Transfer (REST) API endpoint handlers, which fail to enforce the required read_o11y_content capability before processing user requests.\nThis security deficiency allows a low-privileged user lacking 'admin' or 'power' Splunk roles to coerce the application into forwarding proxied requests to the external Splunk Observability Cloud. Consequently, unauthorized actors can exploit this behavior to transmit requests accompanied by the administrative-level Splunk Observability Cloud access token stored securely by the integration.\nThe primary impact of successful exploitation includes unauthorized data disclosure and unauthorized configuration modifications. An attacker leveraging this flaw gains the ability to view all relevant telemetry and monitoring data accessible to the stored access token, as well as execute limited modifications against Splunk Observability Cloud content.\nThe vulnerability affects specific versions of Splunk Enterprise across the 10.x release branches, specifically versions below 10.4.2, 10.2.6, and 10.0.9, while explicitly excluding Splunk Enterprise versions 9.4 and 9.3. Mitigation requires applying the official vendor-supplied software updates to remediate the broken access control mechanism and enforce proper capability checks.",
  "technicalDetails": "The vulnerability is rooted in an improper authorization check within the REST API endpoint handlers of the Splunk App for Splunk Observability Cloud. Architectural design patterns in Splunk applications dictate that sensitive administrative operations and proxy functionalities require explicit capability enforcement to prevent privilege escalation or unauthorized capability delegation.\nSpecifically, the vulnerable endpoint handlers fail to validate whether the executing user possesses the read_o11y_content capability. As a result, users assigned restricted roles that lack administrative or power privileges can interact with the API endpoints.\nWhen a non-privileged user submits a request to the vulnerable REST API endpoints, the application processes the request and acts as a proxy to forward it to the external Splunk Observability Cloud service. Because the application appends or utilizes the pre-configured, highly privileged Splunk Observability Cloud access token stored during app configuration, the external service processes the request with administrative context.\nThe attack flow proceeds as follows: 1) A malicious or unauthorized user with standard user privileges on Splunk Enterprise interacts with the Splunk App for Splunk Observability Cloud REST API endpoints. 2) The vulnerable endpoint handlers omit the mandatory check for the read_o11y_content capability. 3) The application constructs and forwards an outbound request to the Splunk Observability Cloud API, incorporating the stored, highly privileged access token. 4) The Splunk Observability Cloud accepts the request due to the valid administrative token, returning sensitive observability data or executing authorized content modifications.\nThe affected components are the REST API endpoint handlers of the Splunk App for Splunk Observability Cloud deployed on Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9. Authentication is required in the sense that the actor must possess a valid low-privileged Splunk Enterprise user session, but the attack exploits a complete absence of fine-grained privilege requirements at the application layer. The vulnerability facilitates unauthorized data access and limited state alteration on a third-party cloud service via the proxy mechanism of the enterprise software."
}