Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a denial of service. The vulnerability is possible because the Search Head Cluster member control endpoints do not require a state-changing Hypertext Transfer Protocol (HTTP) request type before they apply read-only authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-08-19T22:17:19.680Z",
  "pubdate": "2026-08-19T22:17:19.680Z",
  "executiveSummary": "A denial of service vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe vulnerability allows an authenticated user possessing the high-privilege list_search_head_clustering capability to send unauthorized read requests to Search Head Cluster member control endpoints.\nThis improper handling of HTTP methods permits state-changing actions via read requests, enabling an attacker to alter cluster state and induce a denial of service condition.\nThe risk implication is service degradation or complete interruption of clustering capabilities, impacting high-availability search head deployments.\nExploitation requires authentication with specific high-privilege administrative capabilities within the Splunk environment.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate enforcement of state-changing Hypertext Transfer Protocol (HTTP) request types on Search Head Cluster member control endpoints before applying read-only authorization.\nSpecifically, the vulnerable endpoints fail to strictly validate HTTP methods (such as requiring POST, PUT, or DELETE instead of GET) prior to executing logic that alters the internal state of the search head cluster.\nThe affected components are the Search Head Cluster member control endpoints within Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAttackers must possess a pre-existing Splunk user role that contains the high-privilege list_search_head_clustering capability.\nThe attack flow proceeds as follows: 1) The authenticated malicious actor crafts an unauthorized read request targeting the Search Head Cluster member control endpoints. 2) Because the application logic incorrectly processes the request without enforcing proper state-changing HTTP request type verification, the endpoint accepts the read request as a command to modify the cluster configuration. 3) The cluster state is subsequently changed, disrupting coordination and synchronization among cluster members. 4) This forced state alteration results in a denial of service condition for the Search Head Cluster infrastructure.\nNetwork exposure includes access to the management and clustering interfaces of Splunk Enterprise where Search Head Cluster control endpoints are hosted.\nPost-exploitation impact is constrained to disrupting availability, preventing cluster members from operating cohesively, and disabling search head clustering functionalities."
}