Description

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer (REST) API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulnerability exists because the Edge Processor service endpoint lacks authentication controls. For more information see System architecture of the Edge Processor solution (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/how-the-edge-processor-solution-works/system-architecture-of-the-edge-processor-solution) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T22:17:20.593Z",
  "pubdate": "2026-08-19T22:17:20.593Z",
  "executiveSummary": "An unauthenticated information disclosure vulnerability has been identified in Splunk Enterprise version 10.4 prior to version 10.4.2.\nThe vulnerability allows an unauthenticated remote attacker to retrieve sensitive information contained within Edge Processor pipeline configurations via a Representational State Transfer (REST) API endpoint.\nThis security flaw impacts Splunk Enterprise deployments where the Edge Processor feature is enabled, posing significant risk regarding the exposure of proprietary pipeline logic, data routing rules, and potentially sensitive operational parameters.\nExploitation requires network access to the vulnerable Splunk Enterprise instance with Edge Processor turned on, and no authentication credentials are required by the attacker to query the exposed REST API endpoint.\nOrganizations utilizing affected versions must apply the corresponding software updates to remediate the missing access controls.",
  "technicalDetails": "The root cause of this vulnerability is the complete lack of authentication controls on a specific Representational State Transfer (REST) API endpoint associated with the Edge Processor service within Splunk Enterprise.\nThe vulnerable component is the Edge Processor service endpoint responsible for handling pipeline configuration data when the Edge Processor functionality is activated.\nThe affected product is Splunk Enterprise, specifically version 10.4 variants below 10.4.2. Versions prior to 10.4 are not affected by this vulnerability.\nAttackers can exploit this vulnerability without authentication or elevated privileges by sending a direct HTTP request to the unprotected REST API endpoint over the network.\nStep-by-step attack flow: First, the threat actor identifies a target Splunk Enterprise instance running version 10.4 below 10.4.2 with the Edge Processor solution enabled. Second, the attacker formulates an HTTP request targeted at the unauthenticated Representational State Transfer (REST) API endpoint that manages or serves Edge Processor pipeline configurations. Third, the Splunk Enterprise instance processes the incoming request without validating user identity or session tokens due to missing authentication checks on the service endpoint. Finally, the server responds with the sensitive pipeline configuration data, granting the unauthenticated user unauthorized access to internal data processing rules and architecture details.\nThe post-exploitation impact is limited to unauthorized information disclosure of Edge Processor pipeline configurations, potentially exposing internal data schemas, parsing logic, and routing destinations to unauthorized entities."
}