Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could move files that the user account running Splunk Enterprise can read into a lookup that the user controls. The user could then access all relevant data and affect system integrity and availability on the search head. The vulnerability is possible because the lookup configuration endpoint does not resolve lookup source paths before checking whether they stay inside the allowed lookup staging area. For more information see About lookups (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.4/use-lookups-in-splunk-web/about-lookups) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:15.627Z",
  "pubdate": "2026-08-19T22:17:15.627Z",
  "executiveSummary": "A path traversal vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, specifically residing within the lookup configuration endpoint. This security flaw allows unprivileged users who lack the \"admin\" or \"power\" Splunk roles to manipulate file paths during lookup operations. The primary impact involves unauthorized data access, alongside potential negative consequences for system integrity and availability on the affected search head.\nThe risk implications are significant as unauthorized users can harvest sensitive system data readable by the service account running Splunk Enterprise. Attacker capabilities require authenticated access to the platform without administrative or power privileges, leveraging improper input validation to bypass boundaries designed to restrict file operations to designated staging areas.\nExploitation is driven by the lookup configuration endpoint failing to properly resolve source paths prior to enforcing containment checks. Remediation requires upgrading Splunk Enterprise to the patched version releases specified by the vendor.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate path validation and resolution within the lookup configuration endpoint of Splunk Enterprise. When processing requests related to lookup creation or modification, the vulnerable component fails to properly canonicalize and resolve lookup source paths before evaluating whether the target paths remain securely contained within the allowed lookup staging area.\nBecause path traversal restrictions are applied before resolving relative or symbolic path constructs, a low-privileged user account lacking \"admin\" or \"power\" roles can supply specially crafted paths containing traversal sequences. This allows the user to reference arbitrary files on the underlying filesystem that the user account running the Splunk Enterprise daemon has permissions to read.\nThe attack flow proceeds in a sequential manner. First, an authenticated attacker with standard user privileges interacts with the vulnerable lookup configuration endpoint. Second, the attacker submits a payload designed to target a sensitive file accessible to the Splunk service account. Third, because the lookup configuration endpoint lacks proper path resolution checks, the system accepts the traversal path outside the intended lookup staging area.\nOnce the file is moved into a lookup controlled by the user, the attacker gains direct visibility into the contents of the sensitive file via standard search and lookup query mechanisms. This post-exploitation behavior enables the extraction of sensitive system information, configuration data, or internal logs, thereby compromising confidentiality, system integrity, and availability on the search head.\nThe affected versions comprise Splunk Enterprise instances below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Exploitation requires standard user authentication on the platform, while network exposure corresponds to the standard interfaces used for accessing Splunk Web or REST APIs where lookup configurations are managed."
}