Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information through Splunk Secure Gateway Representational State Transfer (REST) API endpoints. The vulnerability is possible because the affected Security Assertion Markup Language setup and instance settings REST API endpoints do not enforce authorization requirements before returning configuration information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:13.543Z",
  "pubdate": "2026-08-19T22:17:13.543Z",
  "executiveSummary": "An authorization bypass vulnerability exists within Splunk Enterprise and Splunk Secure Gateway, allowing unprivileged users to access sensitive configuration data.\nThe vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, as well as Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70.\nThe weakness stems from a failure to enforce proper access control checks on specific Representational State Transfer (REST) API endpoints.\nAn attacker lacking the 'admin' or 'power' Splunk roles can successfully query these unvalidated endpoints to extract sensitive Security Assertion Markup Language (SAML) setup details and instance settings.\nThe risk implication involves the unauthorized disclosure of sensitive authentication configurations and system settings, which could facilitate subsequent attacks or privilege escalation vectors within the environment.\nExploitation requires network access to the Splunk REST API interface and authenticated low-privilege user capabilities, but does not necessitate administrative privileges.",
  "technicalDetails": "The root cause of the vulnerability is an insufficient authorization enforcement mechanism within the Security Assertion Markup Language setup and instance settings Representational State Transfer (REST) API endpoints provided by the Splunk Secure Gateway component.\nThe vulnerable components are the specific REST API endpoints responsible for exposing SAML setup and instance configuration parameters.\nAffected products and versions include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70.\nAuthentication requirements are minimal; while the request interacts with the REST API, the endpoint fails to validate whether the interacting user possesses the mandatory 'admin' or 'power' Splunk roles.\nPrivilege requirements are low, as any user account lacking administrative or power user capabilities can successfully execute the request.\nNetwork exposure is defined by accessibility to the Splunk management or REST API interface.\nThe attack flow occurs in a direct step-by-step manner: First, an authenticated user without administrative privileges crafts an HTTP request targeting the vulnerable REST API endpoints associated with Splunk Secure Gateway instance settings and SAML configurations. Second, the backend application processes the incoming request without performing adequate role-based access control (RBAC) validation against the session context. Third, the API successfully retrieves and returns the sensitive configuration payload in the HTTP response. Finally, the unprivileged user parses the response, capturing sensitive SAML setup details and instance configuration data.\nThe post-exploitation impact includes the exposure of internal architectural details, authentication parameters, and SAML integration settings, which threat actors can leverage to map the attack surface or plan further targeting."
}