Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile user requests, including tokens that compromise all relevant data available to the affected mobile user, to an attacker-controlled Uniform Resource Locator (URL). The vulnerability is possible because a hard-coded cryptographic key in the Splunk Secure Gateway companion app registration handler allows for arbitrary callback URL registration without restriction. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:17:13.793Z",
  "pubdate": "2026-08-19T22:17:13.793Z",
  "executiveSummary": "An improper authorization and insecure cryptographic implementation vulnerability exists in Splunk Enterprise and Splunk Secure Gateway. The flaw allows unprivileged users lacking \"admin\" or \"power\" roles to register an arbitrary companion app due to the presence of a hard-coded cryptographic key within the companion app registration handler. Successful exploitation enables an attacker to force Splunk Secure Gateway to forward mobile user requests, including sensitive authentication tokens, to an attacker-controlled Uniform Resource Locator (URL). This grants unauthorized access to all relevant data accessible by the affected mobile user. Affected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71. The risk implication is severe, leading to potential data exfiltration and credential compromise across mobile integrations without requiring administrative privileges, provided the attacker can interact with the companion app registration mechanism.",
  "technicalDetails": "The vulnerability resides in the Splunk Secure Gateway companion app registration handler. The root cause of the flaw is the utilization of a hard-coded cryptographic key within the handler logic, which bypasses proper cryptographic verification and access controls. Normally, sensitive registration functions of companion applications should be strictly restricted to privileged users holding specific capabilities or administrative roles such as \"admin\" or \"power\". However, because of the insecure key management and validation implementation, any user who does not hold the \"admin\" or \"power\" Splunk roles can successfully bypass authorization checks.\nThe attack flow proceeds as follows: First, an unprivileged user interacts with the Splunk Secure Gateway companion app registration handler. Utilizing the hard-coded cryptographic key, the user crafts and signs an arbitrary companion app registration payload. Second, the vulnerable handler processes the registration without enforcing appropriate privilege checks or validating the legitimacy of the request against authorized administrative contexts. Third, the attacker registers an arbitrary callback Uniform Resource Locator (URL) of their choosing. Fourth, once the malicious companion app is registered, Splunk Secure Gateway forwards subsequent mobile user requests to the attacker-controlled Uniform Resource Locator (URL). Finally, these forwarded requests contain sensitive authentication tokens and session data, compromising all relevant data available to the affected mobile user and resulting in complete session and data hijacking."
}