Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobile Device Management signing secrets that compromise all affected mobile-device enrollment trust through Splunk Secure Gateway. The vulnerability is possible because Splunk Secure Gateway Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Splunk Secure Gateway administration privileges before processing requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:17:13.670Z",
  "pubdate": "2026-08-19T22:17:13.670Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Splunk Enterprise and Splunk Secure Gateway due to improperly restricted Representational State Transfer (REST) API endpoints.\nThe vulnerability allows an authenticated user with permissions to list storage passwords, but lacking Splunk Secure Gateway administration privileges, to access sensitive Mobile Device Management signing secrets.\nAffected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, as well as Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71.\nThe primary impact of successful exploitation is the compromise of all affected mobile-device enrollment trust managed through Splunk Secure Gateway.\nThe risk implications involve complete integrity and confidentiality compromise of mobile device management configurations and trust relationships.\nAttacker capabilities require valid credentials with permissions to list storage passwords and network access to the Splunk Secure Gateway REST API endpoints.\nNo complex exploitation requirements are necessary beyond possessing the specified storage password listing capability and invoking the vulnerable API endpoints directly.",
  "technicalDetails": "The root cause of the vulnerability is an insufficient access control enforcement mechanism within specific Representational State Transfer (REST) API endpoints of Splunk Secure Gateway.\nSpecifically, the endpoints responsible for deployment bundle operations, Security Assertion Markup Language (SAML) setup, and companion app workflows fail to validate whether the invoking user possesses proper Splunk Secure Gateway administration privileges before processing incoming requests.\nThe vulnerable components are the Splunk Secure Gateway REST API handlers associated with deployment, SAML configuration, and companion app functionalities.\nAffected software iterations include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71.\nAuthentication requirements dictate that the attacker must be an authenticated user within the Splunk environment.\nPrivilege requirements specify that the user must hold a Splunk role capable of listing storage passwords, yet they do not need explicit administrative rights over Splunk Secure Gateway.\nThe attack flow proceeds sequentially: first, the authenticated user identifies or leverages their capability to list storage passwords within the Splunk instance; second, the user interacts directly with the unsecured Splunk Secure Gateway REST API endpoints for deployment bundles, SAML setup, or companion app workflows; third, the endpoints process the requests without verifying Splunk Secure Gateway administration privileges; fourth, the API returns Mobile Device Management signing secrets to the unauthorized user.\nThe post-exploitation impact centers on the extraction of cryptographic signing secrets, which effectively compromises the enrollment trust architecture for all mobile devices governed through Splunk Secure Gateway."
}