Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to the Splunk Enterprise Representational State Transfer (REST) API using a system-level session token and modify the Splunk platform configuration. The user could then obtain a session token without a password and use it to access all relevant data and affect system integrity. The vulnerability is possible because Splunk Secure Gateway does not validate decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:20.070Z",
  "pubdate": "2026-08-19T22:17:20.070Z",
  "executiveSummary": "An improper input validation vulnerability exists in Splunk Enterprise and Splunk Secure Gateway, allowing low-privileged users to achieve unauthorized privilege escalation and system configuration modification.\nThe vulnerability allows an authenticated user lacking the \"admin\" or \"power\" Splunk roles to leverage crafted report notification data to interact with the Splunk Enterprise Representational State Transfer (REST) API using a system-level session token.\nAffected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70.\nSuccessful exploitation results in the unauthorized acquisition of a session token without requiring a password, enabling the attacker to access all relevant system data and compromise overall system integrity.\nThe attack requires an authenticated user with standard privileges who can supply specially crafted report notification data to trigger the improper handling within the application logic.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation within Splunk Secure Gateway, specifically the failure to validate decoded report notification identifiers prior to using them in the construction of requests directed to the Splunk Enterprise Representational State Transfer (REST) API.\nThe vulnerable component is the Splunk Secure Gateway integration module within Splunk Enterprise. The affected software versions comprise Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, alongside Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70.\nAuthentication and privilege requirements dictate that the attacker must possess an authenticated Splunk account; however, the user must not hold elevated roles such as \"admin\" or \"power\".\nThe step-by-step attack flow proceeds as follows: First, the low-privileged user constructs malicious or crafted report notification data containing manipulated identifiers. Second, the user submits this data to the application. Third, because Splunk Secure Gateway fails to validate the decoded report notification identifiers, it uses them to programmatically construct and dispatch an API request to the Splunk Enterprise REST API. Fourth, this request executes under the authority of a system-level session token.\nAs a result of this privileged API request execution, the attacker is able to modify critical Splunk platform configurations. Following the configuration modification, the attacker can successfully acquire a high-privilege session token without needing to supply a valid user password.\nIn terms of post-exploitation impact, the acquired session token grants the attacker unrestricted access to all relevant system data and the ability to severely affect and compromise system integrity across the Splunk deployment."
}