Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated requests to internal Splunk services, which could allow for changes to Search Head Cluster state and a denial of service. The vulnerability is possible because Splunk Secure Gateway does not validate report notification path values before it sends internal requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T22:17:19.553Z",
  "pubdate": "2026-08-19T22:17:19.553Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Splunk Enterprise and Splunk Secure Gateway. The flaw allows authenticated users lacking 'admin' or 'power' privileges to leverage report notifications to transmit system-authenticated requests targeting internal Splunk services. Successful exploitation enables unauthorized alterations to the Search Head Cluster state, resulting in a denial of service (DoS). The root cause stems from the failure of Splunk Secure Gateway to properly validate report notification path values prior to dispatching internal requests. The impact affects system availability and cluster integrity, posing a significant risk to enterprise deployments. Attackers require low-privilege standard user access to initiate the malicious report notification payloads, exploiting the trust boundary between the reporting component and internal administrative services.",
  "technicalDetails": "The vulnerability is classified as a Server-Side Request Forgery (SSRF) flaw residing within the Splunk Secure Gateway component of Splunk Enterprise. The affected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, alongside Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70. The root cause of the vulnerability is the absolute absence of input validation and sanitization checks on report notification path values handled by Splunk Secure Gateway before it generates and transmits internal HTTP requests.\nAuthentication is required to exploit this vulnerability, but the privilege requirements are minimal; a user who does not hold the elevated 'admin' or 'power' Splunk roles possesses sufficient access to configure or trigger the malicious report notifications. The attack flow commences when a low-privileged user crafts a report notification containing a manipulated path value pointing to sensitive internal Splunk endpoints. Because Splunk Secure Gateway processes these path values without validation, it issues internal requests using system-level authentication credentials.\nThe payload behavior forces the underlying system to make unintended calls to internal microservices and APIs. By targeting internal Splunk services, the attacker can interact with components managing the Search Head Cluster state. The post-exploitation impact includes unauthorized state modifications and a subsequent denial of service (DoS) affecting the availability and stability of the Splunk environment. Network exposure is constrained to internal service boundaries, but the inherent system-level trust allows requests originating from the SSRF vector to bypass standard role-based access control (RBAC) boundaries within the application."
}