Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and disrupt service. The vulnerability is possible because knowledge bundle delta processing does not restrict removal paths to the staging directory and the endpoint does not enforce the expected authorization boundary. For more information see Knowledge bundle replication overview (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/knowledge-bundle-replication/knowledge-bundle-replication-overview) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T22:17:20.340Z",
  "pubdate": "2026-08-19T22:17:20.340Z",
  "executiveSummary": "An arbitrary file deletion vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe vulnerability allows a low-privileged user lacking 'admin' or 'power' Splunk roles to submit a crafted knowledge bundle delta to a cluster manager.\nSuccessful exploitation results in the deletion of arbitrary files accessible to Splunk Enterprise, impacting system integrity and causing service disruption.\nThe flaw stems from insufficient input validation and missing authorization checks within the knowledge bundle delta processing mechanism, which fails to restrict removal paths to the designated staging directory.\nAn attacker requires network access to the cluster manager endpoint and the ability to submit knowledge bundle deltas without administrative privileges, bypassing expected authorization boundaries to execute destructive file operations.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of knowledge bundle delta processing on the cluster manager within Splunk Enterprise.\nSpecifically, the affected component fails to enforce expected authorization boundaries and does not properly restrict file removal paths to the intended staging directory.\nBecause authorization checks are omitted or inadequately enforced on the endpoint, users who do not possess the 'admin' or 'power' Splunk roles are improperly permitted to interact with the bundle delta functionality.\nDuring exploitation, an attacker submits a specially crafted knowledge bundle delta payload containing malicious file path traversal sequences or absolute paths.\nBecause the validation logic does not restrict deletions to the staging directory, the processing engine interprets the crafted path and deletes arbitrary files on the underlying filesystem that are accessible to the Splunk Enterprise process user.\nThe attack flow proceeds as follows: 1) The unprivileged user crafts a malicious knowledge bundle delta request. 2) The user transmits the request to the vulnerable cluster manager endpoint. 3) The endpoint accepts the request due to missing authorization enforcement. 4) The processing engine evaluates the delta payload without path restriction validation. 5) The application executes the deletion command against arbitrary paths on the host filesystem.\nAffected software versions include Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe post-exploitation impact includes severe system integrity compromise and localized denial of service resulting from the removal of critical application binaries, configuration files, or operational data accessible to the Splunk service account."
}