Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running Splunk Enterprise, which could allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the generic transforms configuration endpoints do not enforce the capabilities required to create or edit external lookup definitions. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) and limits.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/limits.conf) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:20.210Z",
  "pubdate": "2026-08-19T22:17:20.210Z",
  "executiveSummary": "A privilege escalation vulnerability exists in Splunk Enterprise that allows unprivileged users lacking the 'admin' or 'power' roles to create or modify scripted lookups.\nThe vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe root cause stems from generic transforms configuration endpoints failing to properly enforce the necessary capabilities required for creating or editing external lookup definitions.\nAn authenticated attacker with standard user privileges can leverage generic configuration endpoints to execute an installed lookup script.\nExecution occurs under the security context of the user account running the Splunk Enterprise service, leading to unauthorized access to relevant data, as well as potential impacts on system integrity and availability.\nSuccessful exploitation requires valid user authentication but bypasses role-based capability checks normally enforced on administrative configuration interfaces.",
  "technicalDetails": "The vulnerability resides within the configuration management subsystem of Splunk Enterprise, specifically handling generic transforms configuration endpoints.\nThe vulnerable component fails to validate whether the invoking user possesses the specific capabilities required to create or edit external and scripted lookup definitions.\nAffected software versions include Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAuthentication is required to interact with the Splunk Enterprise instance, but the attacker is not required to possess the 'admin' or 'power' roles.\nThe attack flow proceeds as follows: 1) An authenticated user with standard privileges accesses the generic transforms configuration endpoints. 2) The user issues an HTTP request to create or modify a scripted lookup definition, bypassing the capability checks designed to restrict external lookup creation to administrative roles. 3) The user triggers the execution of an installed lookup script via the newly created or modified lookup definition. 4) The lookup script executes on the underlying operating system with the privileges of the user account running the Splunk Enterprise process.\nPost-exploitation impact includes unauthorized access to sensitive operational and indexed data accessible to the Splunk daemon account, potential code execution on the host system depending on script contents, and degradation of system integrity and availability."
}