Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material. For more information see About distributed search (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-distributed-search/about-distributed-search) and authentication.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/authentication.conf) in Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T22:17:18.360Z",
  "pubdate": "2026-08-19T22:17:18.360Z",
  "executiveSummary": "An unauthenticated session token forgery vulnerability exists in Splunk Enterprise distributed search functionality. The flaw allows an unauthenticated attacker possessing a trusted distributed search private key to forge an administrative session token. Affected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Successful exploitation grants unauthorized access to all relevant data, compromises system integrity, and disrupts service availability. The risk implications are severe, as administrative privileges are gained without prior authentication by abusing cryptographic fallback mechanisms within distributed search operations. Exploitation requires network access to the distributed search authentication token endpoint and possession of the trusted distributed search private key material.",
  "technicalDetails": "The vulnerability resides in the distributed search authentication token endpoint of Splunk Enterprise. The root cause of the flaw is that the endpoint fails to enforce signed requests to properly identify a configured search peer. When a request lacks the required cryptographic signature validation, the system falls back to shared local key material. An unauthenticated attacker who has obtained access to a trusted distributed search private key can exploit this fallback behavior. The attack flow begins with the adversary crafting a request to the distributed search authentication token endpoint. Because signature verification is insufficiently enforced and relies on fallback mechanisms utilizing shared local key material, the application incorrectly validates the request against the compromised private key. This processing flaw allows the attacker to forge a valid administrative session token. Following successful token generation, the adversary gains elevated administrative privileges, enabling them to access sensitive data across the deployment, manipulate system configurations to affect integrity, and execute actions that disrupt service availability. The vulnerable component is the distributed search authentication token handler, affecting Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The attack requires network exposure to the vulnerable endpoint and possession of the trusted distributed search private key, while operating without any pre-existing user authentication."
}