Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the "admin" Splunk role. The vulnerability is possible because embedded report access does not block Representational State Transfer (REST) API dispatch archive download requests. For more information see Additional configuration for embedded reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/9.1/report-management/additional-configuration-for-embedded-reports) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-08-19T22:17:14.700Z",
  "pubdate": "2026-08-19T22:17:14.700Z",
  "executiveSummary": "Splunk Enterprise contains an access control vulnerability within its embedded reporting mechanism that allows unauthenticated external actors to compromise system integrity and access restricted data. The vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The root cause stems from the application failing to properly restrict Representational State Transfer (REST) API search job dispatch archive download requests when accessed via an embedded report token. An unauthenticated attacker possessing a valid embedded report token can exploit this flaw by downloading the associated search job dispatch archive, extracting session material from the artifact, and leveraging those recovered session credentials to impersonate the report owner. The risk implications are severe, as the impact is directly tied to the privileges of the report owner. If the report owner holds the administrative 'admin' Splunk role, the attacker inherits full administrative capabilities, enabling them to execute administrative actions, access all data streams available to that user, and completely compromise system integrity. Exploitation requires no prior authentication to the platform, provided the attacker has obtained an embedded report token and can interact with the vulnerable REST API endpoints over the network.",
  "technicalDetails": "The vulnerability resides in the Splunk Enterprise REST API endpoint handling search job dispatch archives for embedded reports. Specifically, the vulnerable component fails to enforce proper authorization checks and request restrictions on Representational State Transfer (REST) API endpoints when they are accessed in the context of embedded dashboards and reports. In a secure architecture, embedded report tokens should strictly limit exposure to the rendered visualization data contained within the specific report. However, due to this access control oversight, the validation logic does not block requests originating from or associated with embedded report tokens when querying the search job dispatch archive download functionality.\nThe step-by-step attack flow begins with an unauthenticated attacker obtaining a valid embedded report token, which may be exposed via public-facing dashboards or web application monitoring. Using this token, the attacker interacts with the Splunk Enterprise REST API, bypassing standard authentication gates that normally protect sensitive backend operations. The attacker requests the search job dispatch archive associated with the embedded report. Because the API improperly honors the token for this restricted action, the server returns the requested dispatch archive.\nOnce the archive is successfully retrieved, the attacker parses the contents to recover embedded session material, tokens, or credentials stored or leaked within the dispatch artifacts. With the recovered session material in hand, the attacker establishes a valid user session within Splunk Enterprise. The attacker then uses this session to execute arbitrary operations within the scope of the report owner's access control context. If the report owner possesses high-privilege permissions, such as the 'admin' Splunk role, the attacker achieves full administrative control over the Splunk Enterprise instance. This allows them to read all relevant data available to the owner, configure system settings, modify users, and severely affect overall system integrity. The vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and requires network exposure to the Splunk REST API along with the possession of a valid embedded report token."
}