Description

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 (SPL2) modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk Enterprise versions below 10.2. The broken object level authorization is possible because the data management orchestrator does not verify that the requesting user owns the target resources before it deletes the modules. For more information see Manage SPL2-based apps (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/meet-splunk-apps/manage-spl2-based-apps) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T22:17:14.447Z",
  "pubdate": "2026-08-19T22:17:14.447Z",
  "executiveSummary": "A Broken Object Level Authorization (BOLA) vulnerability exists in Splunk Enterprise versions below 10.4.2 and 10.2.6. The flaw resides within the data management orchestrator interface and affects Splunk Processing Language version 2 (SPL2) modules. The vulnerability impacts Splunk Enterprise systems running versions 10.2 and above, specifically those below the patched thresholds. The risk implication centers around unauthorized data manipulation and loss of integrity, allowing a malicious actor or low-privileged user to delete valuable application artifacts belonging to other users. The attack capability requires a valid user account lacking the 'admin' or 'power' Splunk roles, enabling them to bypass authorization boundaries and successfully target resources they do not own. Exploitation requires authenticated access to the vulnerable Splunk Enterprise instance and interaction with the data management orchestrator interface.",
  "technicalDetails": "The vulnerability is caused by a Broken Object Level Authorization (BOLA) flaw in the data management orchestrator interface of Splunk Enterprise. Specifically, the data management orchestrator fails to perform adequate authorization checks to verify whether the requesting user owns the target resources prior to executing deletion operations. The affected component is the data management orchestrator handling Splunk Processing Language version 2 (SPL2) modules. The affected versions include Splunk Enterprise versions below 10.4.2 and 10.2.6 (affecting versions 10.2 and above). The authentication requirements dictate that the attacker must possess a valid user session, though the user does not hold the 'admin' or 'power' Splunk roles. Privilege requirements are minimal, as standard or low-privileged users can execute the attack. The step-by-step exploitation flow involves the following phases: First, an authenticated user without administrative or power privileges interacts with the data management orchestrator interface. Second, the user initiates a deletion request targeting a specific Splunk Processing Language version 2 (SPL2) module owned by a different user. Third, the data management orchestrator processes the deletion request without validating object ownership or authorization context. Finally, the system successfully deletes the target SPL2 module, resulting in unauthorized resource destruction and potential disruption of dependent applications or data management workflows. Post-exploitation impact includes the permanent deletion of critical user data, sabotage of analytics pipelines, and degradation of system integrity within the affected Splunk Enterprise environment."
}