Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges, expose all relevant data, and affect system integrity and availability on the search head. The vulnerability is possible because the search scheduler passes a system-level authentication context rather than the action owner context to the email alert action when it renders PDF attachments. For more information see alert_actions.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/alert_actions.conf) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:19.937Z",
  "pubdate": "2026-08-19T22:17:19.937Z",
  "executiveSummary": "A privilege escalation vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises from an improper authentication context handling mechanism within the search scheduler when processing email alert actions containing Portable Document Format (PDF) attachments. An authenticated user holding a role with the schedule_search capability can leverage this flaw to execute arbitrary Search Processing Language (SPL) commands with elevated system-level privileges.\nThe successful exploitation of this vulnerability compromises system integrity and confidentiality by exposing all relevant data accessible to the system-level context, while also threatening system availability on the search head. The risk implications are severe, as low-privileged users possessing specific scheduling capabilities can effectively bypass intended authorization boundaries and execute administrative-level queries.\nAttackers require a pre-existing user account with the schedule_search capability and must configure malicious PDF attachments within the email alert action workflow. Remediation requires upgrading Splunk Enterprise to the specified patched versions or implementing strict administrative controls over search scheduling and alert action configurations.",
  "technicalDetails": "The root cause of the vulnerability resides in the search scheduler's execution logic when rendering Portable Document Format (PDF) attachments via the email alert action workflow. Instead of passing the authentication context of the action owner or the user who triggered the alert, the search scheduler incorrectly passes a system-level authentication context to the email alert action.\nThe vulnerable component is the search scheduler and its interaction with email alert action workflows and PDF generation handlers, as referenced in alert_actions.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/alert_actions.conf). Affected versions include Splunk Enterprise variants below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nTo exploit this vulnerability, an attacker must possess authentication credentials and hold a role assigned with the schedule_search capability. The attack flow proceeds as follows: First, the authenticated user configures an email alert action featuring a Portable Document Format (PDF) attachment designed to execute arbitrary Search Processing Language (SPL) commands. Second, when the scheduled search triggers, the search scheduler invokes the email alert action workflow.\nDuring the rendering of the PDF attachment, the search scheduler supplies the aforementioned system-level authentication context rather than restricting execution to the privileges of the action owner. Consequently, the arbitrary SPL commands embedded within or triggered by the workflow execute with elevated system-level privileges.\nThe payload behavior involves the execution of unauthorized SPL operations that bypass standard Role-Based Access Control (RBAC) restrictions. The post-exploitation impact includes the exposure of restricted data repositories, potential data exfiltration, and operational disruption affecting system integrity and availability on the affected search head."
}