Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the rest_properties_get capability could read encrypted stored credentials through the Representational State Transfer (REST) API. Successful exploitation can expose relevant data protected by the stored credentials. The incorrect permission assignment is possible because the properties REST endpoint requires the rest_properties_get capability instead of the list_storage_passwords capability to read stored credentials. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:17:14.063Z",
  "pubdate": "2026-08-19T22:17:14.063Z",
  "executiveSummary": "An incorrect permission assignment vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, which allows unauthorized access to sensitive data.\nThe vulnerability type is an improper authorization flaw resulting in the exposure of encrypted stored credentials.\nThe primary impact is the potential exposure of sensitive information and relevant data protected by stored credentials via the Representational State Transfer (REST) API.\nAffected systems include Splunk Enterprise instances running versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe risk implication is that malicious actors or internal users with elevated or improper role configurations can read sensitive cryptographic material or authentication secrets without possessing the strict administrative privileges normally required.\nAttacker capabilities require holding a specific role assigned with the rest_properties_get capability to successfully execute requests against the vulnerable endpoint.\nExploitation requirements dictate that the target user must have access to the Representational State Transfer (REST) API and a role configured with the aforementioned capability.",
  "technicalDetails": "The root cause of the vulnerability stems from an incorrect permission assignment within the properties Representational State Transfer (REST) endpoint in Splunk Enterprise.\nSpecifically, the properties REST endpoint improperly requires only the rest_properties_get capability instead of the stricter list_storage_passwords capability to read stored credentials.\nThe vulnerable component is the properties REST endpoint handling configuration properties and credential storage in Splunk Enterprise.\nAffected versions comprise Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAuthentication requirements dictate that the attacker must be authenticated to the platform and hold a role equipped with the rest_properties_get capability.\nPrivilege requirements are limited to holding the rest_properties_get capability rather than dedicated administrative capabilities like list_storage_passwords.\nNetwork exposure is defined by accessibility to the Representational State Transfer (REST) API exposed by Splunk Enterprise.\nThe attack flow proceeds as follows: First, an authenticated user or attacker obtains a role that possesses the rest_properties_get capability. Second, the attacker interacts with the Representational State Transfer (REST) API targeting the properties REST endpoint. Third, the endpoint processes the request by validating the user against the insufficient rest_properties_get capability rather than enforcing the required list_storage_passwords capability. Finally, the endpoint returns the encrypted stored credentials to the caller.\nPost-exploitation impact includes the successful exposure of relevant data protected by the stored credentials, which may facilitate further unauthorized access or lateral movement within connected systems."
}