Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fsh_manage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the Federated Search dispatch flow accepts caller-controlled bundle selection without enforcing the capability that manages federated providers and indexes. For more information see Security models for Federated Search for Splunk (https://help.splunk.com/en/splunk-enterprise/search/federated-search/10.4/run-federated-searches-across-other-splunk-deployments/service-accounts-and-security-for-federated-search-for-splunk/security-models-for-federated-search-for-splunk) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:15.880Z",
  "pubdate": "2026-08-19T22:17:15.880Z",
  "executiveSummary": "A remote code execution vulnerability exists in Splunk Enterprise involving the Federated Search bundle selection mechanism.\nThe flaw allows a low-privileged user lacking the fsh_manage capability to execute arbitrary code.\nAffected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe risk implications are severe, as successful exploitation compromises data confidentiality, system integrity, and system availability, granting unauthorized access to all relevant data.\nAttacker capabilities require low privileges on the platform, bypassing standard authorization checks to perform remote code execution.\nExploitation is driven by flaws in the dispatch flow which accepts caller-controlled bundle selections without properly enforcing capability checks for managing federated providers and indexes.",
  "technicalDetails": "The root cause of the vulnerability stems from improper authorization enforcement within the Federated Search dispatch flow in Splunk Enterprise.\nSpecifically, the component handling Federated Search bundle selection accepts caller-controlled bundle selections without verifying whether the initiating user holds the mandatory fsh_manage capability.\nThis capability is explicitly designed to govern the management of federated providers and indexes.\nThe affected component is the Federated Search dispatch flow within Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAuthentication is required to interact with the platform, but the privilege requirement is low, as the user executing the attack does not need administrative privileges or the fsh_manage capability.\nThe attack flow proceeds as follows: First, an authenticated, low-privileged user crafts a malicious request targeting the Federated Search dispatch mechanism. Second, the user supplies a caller-controlled bundle selection payload designed to exploit the missing validation logic. Third, because the underlying dispatch flow fails to enforce the fsh_manage capability check, the system processes the unverified bundle. Finally, processing the manipulated bundle selection results in remote code execution on the underlying system.\nPost-exploitation impact includes full system compromise, granting the attacker access to all relevant data processed by the search environment, thereby undermining the confidentiality, integrity, and availability of the Splunk deployment."
}