Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the Representational State Transfer (REST) API endpoint for knowledge bundle upload does not require the high-privilege capability edit_dist_peer, and distributed search accepts caller-supplied knowledge bundle selections from users who do not hold that capability. For more information see What search heads send to search peers (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.2/knowledge-bundle-replication/what-search-heads-send-to-search-peers), About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.0/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.1/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and Using the REST API reference (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/introduction/using-the-rest-api-reference) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:15.117Z",
  "pubdate": "2026-08-19T22:17:15.117Z",
  "executiveSummary": "A Remote Code Execution (RCE) vulnerability exists in Splunk Enterprise that allows unprivileged users to execute arbitrary code on the underlying system. The flaw stems from insufficient access controls on a REST API endpoint and the distributed search mechanism. Specifically, users lacking administrative or power roles can upload malicious knowledge bundles and force their usage in distributed search operations. Successful exploitation enables unauthorized actors to compromise system integrity, availability, and access all relevant operational data. The risk level is critical, as it bridges the gap between low-privileged access and complete system compromise within affected Splunk Enterprise deployments below versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Exploitation requires the ability to interact with the REST API and upload specifically crafted knowledge bundles designed for distributed search execution.",
  "technicalDetails": "The vulnerability resides within the Splunk Enterprise distributed search subsystem and its associated Representational State Transfer (REST) API endpoints. The root cause of the flaw is an authorization validation failure: the specific REST API endpoint designated for knowledge bundle uploads fails to enforce the required high-privilege capability known as edit_dist_peer. Additionally, the distributed search architecture improperly accepts caller-supplied knowledge bundle selections originating from users who do not possess this requisite capability. Authentication is required to interact with the REST API, but privilege enforcement fails because standard, non-administrative, and non-power users can bypass role-based access control (RBAC) boundaries designed to restrict sensitive configuration and execution capabilities.\nThe step-by-step attack flow proceeds as follows: First, an authenticated user lacking administrative or power roles interacts with the vulnerable REST API endpoint to upload a maliciously crafted knowledge bundle. Second, the user initiates or forces a distributed search operation that references this newly uploaded, untrusted knowledge bundle. Third, because the distributed search infrastructure blindly trusts caller-supplied bundle selections without verifying the caller's possession of the edit_dist_peer capability, the search peers ingest and process the malicious bundle. Finally, processing the payload results in arbitrary code execution on the targeted system under the context of the Splunk process.\nThe vulnerable components involve the REST API handling mechanism for knowledge bundle uploads and the distributed search peer validation logic. Affected product versions comprise Splunk Enterprise instances below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The post-exploitation impact includes full system compromise, granting the attacker access to all relevant data processed by the Splunk instance, as well as severe degradation of system integrity and availability."
}