Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST) API request that deletes or temporarily overwrites files writable by the user account running Splunk Enterprise processes on a non-captain search head cluster member. The vulnerability is possible because Search Head Clustering bundle replication does not validate the name of a replicated bundle file or neutralize NUL bytes before constructing the member bundle path. For more information see About search head clustering (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-search-head-clustering/about-search-head-clustering), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and Secure Splunk Enterprise service accounts (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.0/install-splunk-enterprise-securely/secure-splunk-enterprise-service-accounts) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T22:17:20.463Z",
  "pubdate": "2026-08-19T22:17:20.463Z",
  "executiveSummary": "Splunk Enterprise contains an improper input validation vulnerability within its Search Head Clustering bundle replication mechanism, allowing authenticated users lacking \"admin\" or \"power\" roles to impact system integrity and availability.\nThe vulnerability affects non-captain search head cluster members across multiple product branches by enabling arbitrary file deletion or temporary file overwriting on the underlying host filesystem.\nAn attacker with standard user privileges can leverage this flaw through crafted Representational State Transfer (REST) API requests, exploiting the lack of filename validation and NUL byte neutralization during bundle replication.\nSuccessful exploitation requires network access to the Splunk Enterprise instance, standard user authentication, and targets files writable by the specific OS user account executing Splunk Enterprise processes.\nThe primary risk implications involve unauthorized modification or removal of critical system files, leading to denial of service conditions or operational disruption of the affected search head cluster node.",
  "technicalDetails": "The root cause of the vulnerability resides in the Search Head Clustering bundle replication subsystem of Splunk Enterprise, specifically failing to validate the naming parameters of replicated bundle files and omitting the neutralization of NUL bytes.\nWhen the replication mechanism constructs destination member bundle paths, the unvalidated and un-sanitized input strings permit path manipulation constructs.\nThe vulnerable component is the Search Head Clustering bundle replication handler, exposed via the Representational State Transfer (REST) API interface.\nAffected product versions include Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAuthentication requirements dictate that the attacking principal must be authenticated against the Splunk Enterprise instance, but privilege requirements are restricted such that the user does not need to hold the \"admin\" or \"power\" Splunk roles.\nNetwork exposure is present wherever the Representational State Transfer (REST) API is accessible to authenticated users.\nThe attack flow proceeds as follows: First, an authenticated low-privileged user interacts with the Representational State Transfer (REST) API by submitting a crafted request containing specially formatted file parameters or NUL bytes designed to manipulate path resolution during bundle replication.\nSecond, the non-captain search head cluster member processes the replication request, consuming the unvalidated bundle file name without neutralizing embedded control characters or path traversal sequences.\nThird, as the system constructs the destination member bundle path, the manipulated string evaluates to target unintended filesystem locations outside the intended storage directory.\nFinally, the payload behavior results in the deletion or temporary overwriting of arbitrary files on the local filesystem that possess write permissions granted to the specific operating system user account running the Splunk Enterprise processes.\nThe post-exploitation impact degrades system integrity and availability, potentially rendering the targeted search head cluster member unstable or inoperable due to missing or corrupted operational files."
}