EUVD-2026-36086
GHSA-6722-h93g-5wxq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could send server-side requests to arbitrary internal destinations through the Dashboard Studio PDF export feature.
The vulnerability exists because the trusted-domain validation uses a prefix match that can be bypassed with attacker-controlled subdomains (for example, docs.splunk.com.evil.com), and because the PDF export service follows HTTP redirects automatically without re-validating each redirect target against the allowlist.
AnalysisAI
Server-side request forgery in Splunk Enterprise (below 10.2.4, 10.0.7, 9.4.12, 9.3.13) and Splunk Cloud Platform lets a low-privileged authenticated user coerce the Dashboard Studio PDF export feature into issuing HTTP requests to arbitrary internal destinations. The flaw stems from a flawed prefix-match on trusted domains plus uncritical redirect-following by the PDF export service. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
The Dashboard Studio PDF export feature in Splunk renders dashboards server-side, which requires the export service to fetch resources over HTTP. To prevent abuse, Splunk maintains an allowlist of trusted domains for these outbound fetches. This CVE is a textbook CWE-918 (Server-Side Request Forgery) issue with two compounding defects: the allowlist check uses a string prefix match rather than full hostname/eTLD+1 equality, so an attacker-controlled hostname such as 'docs.splunk.com.evil.com' satisfies a 'starts with docs.splunk.com' test while resolving to an attacker zone; and the export service follows HTTP 3xx redirects without re-applying allowlist validation on each hop, so even a legitimate initial host can be used as a redirector to internal targets. The affected CPEs are cpe:2.3:a:splunk:splunk_enterprise and cpe:2.3:a:splunk:splunk_cloud_platform.
RemediationAI
Vendor-released patch: upgrade Splunk Enterprise to 10.2.4, 10.0.7, 9.4.12, or 9.3.13 (or later in each respective branch), per SVD-2026-0602 at https://advisory.splunk.com/advisories/SVD-2026-0602; Splunk Cloud Platform customers should ensure their tenant is on 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, or 9.3.2411.132 or later (cloud upgrades are typically managed by Splunk). If patching cannot occur immediately, the most direct compensating control is to disable the Dashboard Studio PDF export feature, which removes the vulnerable code path entirely at the cost of losing PDF export functionality for dashboard users; alternatively, restrict the export/render service's egress at the network layer to only the specific external hosts it legitimately needs and block access to internal RFC1918 ranges and cloud metadata endpoints (e.g., 169.254.169.254), which preserves PDF export for whitelisted destinations but requires accurate egress policy and may break legitimate fetches from other domains. Audit and tighten which roles can create or run Dashboard Studio dashboards to reduce the population of users who can reach the export feature.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today