Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every credential stored in the credential store, which can allow for disclosure and modification of all relevant data and affect system integrity and availability. The vulnerability is possible because scheduled search alert action configuration does not properly restrict user-specific alert action settings before the search scheduler runs alert actions. For more information see Create scheduled alerts (https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.3/create-alerts/create-scheduled-alerts), Set up alert actions (https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.3/configure-alert-actions/set-up-alert-actions), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and Configuration file precedence (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-splunk-enterprise-with-configuration-files/configuration-file-precedence) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:13.130Z",
  "pubdate": "2026-08-19T22:17:13.130Z",
  "executiveSummary": "A privilege escalation vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The flaw allows authenticated users assigned a role containing the schedule_search capability to execute arbitrary Search Processing Language (SPL) commands with the highest level of system privilege. This security deficiency enables attackers to read every credential stored within the credential store, leading to the potential disclosure, modification, and deletion of all relevant data, while severely compromising overall system integrity and availability.\nThe root cause stems from improper input restriction and handling of user-specific alert action configurations prior to execution by the search scheduler. Successful exploitation requires an attacker to hold a role with the schedule_search capability, enabling them to leverage alert action configurations to bypass intended security boundaries. The resulting impact spans complete confidentiality compromise of stored credentials, unauthorized data manipulation, and administrative-level command execution across the affected Splunk Enterprise platform.",
  "technicalDetails": "The vulnerability resides within the scheduled search alert action configuration and execution mechanism of Splunk Enterprise. Specifically, the affected component fails to properly restrict or sanitize user-specific alert action settings before the search scheduler initiates and processes alert actions. This flaw allows a malicious or compromised user holding the standard schedule_search capability to manipulate alert action configurations.\nDuring normal operations, scheduled searches and their associated alert actions are governed by role-based access controls and intended SPL command restrictions. However, because of the improper validation and restriction of user-specific configurations prior to scheduler execution, an attacker can craft payloads that force the search scheduler to execute arbitrary Search Processing Language (SPL) commands. These commands are executed with the highest level of system privilege available to the underlying scheduling engine, effectively bypassing intended functional constraints tied to the user's assigned role.\nThe exploitation flow proceeds as follows: First, an authenticated actor with the schedule_search capability configures or modifies a scheduled search alert action using maliciously constructed parameters. Second, when the search scheduler triggers the alert action, the system processes the unvalidated user-specific configuration without applying the necessary privilege boundaries. Third, the search scheduler executes arbitrary SPL commands under the highest system privilege context. Finally, leveraging these elevated privileges, the attacker interacts with the credential store to read every stored credential, enabling subsequent post-exploitation activities such as unauthorized data access, modification, and systemic disruption affecting confidentiality, integrity, and availability.\nAffected versions include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability requires authentication and a specific capability (schedule_search), but requires no network exposure beyond standard access to the Splunk Enterprise instance. The post-exploitation impact includes full compromise of the credential store, arbitrary command execution, and broad data exposure across the platform."
}