Description

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer (REST) API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because the REST API does not require authentication or the change_authentication capability for the token-key reload action. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T22:17:18.623Z",
  "pubdate": "2026-08-19T22:17:18.623Z",
  "executiveSummary": "An unauthenticated security vulnerability exists within the Representational State Transfer (REST) API of Splunk Enterprise versions 10.4 through 10.4.1, specifically involving the token-signing key reload functionality.\nThe vulnerability allows remote, unauthenticated attackers to trigger the reloading of token-signing keys via the application's REST API without requiring any valid session tokens, credentials, or administrative privileges such as the change_authentication capability.\nExploitation of this vulnerability directly impacts the integrity and availability of authentication mechanisms relying on cryptographic tokens within the Splunk Enterprise platform.\nThe root cause stems from improper access control enforcement on a sensitive administrative REST API endpoint, omitting both authentication checks and authorization capability validations.\nSuccessful exploitation requires network access to the Splunk Enterprise REST API interface.\nThe risk implication involves potential disruption of authentication services and cryptographic token validation across the affected Splunk deployment.",
  "technicalDetails": "The vulnerability resides in the Representational State Transfer (REST) API component of Splunk Enterprise versions 10.4 below 10.4.2.\nThe vulnerable component handles administrative actions, specifically the token-signing key reload functionality.\nThe root cause of the vulnerability is the complete absence of authentication enforcement and authorization capability validation for the specific REST API action responsible for reloading token-signing keys.\nUnlike securely designed administrative endpoints that mandate valid session credentials and specific authorization checks—such as the change_authentication capability—the affected API endpoint processes incoming requests directly from unauthenticated clients.\nThe attack flow proceeds as follows: An unauthenticated remote attacker sends a specially crafted HTTP request targeting the specific REST API endpoint designated for token-signing key reloading within Splunk Enterprise.\nBecause the application fails to validate the identity of the requester or check for required administrative capabilities, the REST API handler immediately executes the backend function responsible for reloading cryptographic token-signing keys.\nNetwork exposure is defined by accessibility to the Splunk Enterprise REST API port.\nNo specific payload behavior beyond a targeted HTTP request to the vulnerable endpoint is required to trigger the unintended administrative action.\nThe post-exploitation impact includes the potential invalidation or disruption of existing cryptographic authentication tokens, leading to denial of service for legitimate users relying on token-based authentication mechanisms within the affected Splunk Enterprise environment."
}