EUVD-2026-44738
GHSA-xqm2-gqcq-fc3q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network attack via SPL/REST with low privilege required; AC:H reflects need for specific endpoint knowledge; confidentiality-only impact with no integrity or availability effect.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could view stored credential hashes when they access the /servicesNS/-/-/storage/passwords REST endpoint through the |rest Search Processing Language (SPL) command.<br><br>The exposure happens because the |rest SPL command returns the encr_password field in the results of the /servicesNS/-/-/storage/passwords REST endpoint.
AnalysisAI
Credential hash exposure in Splunk Enterprise and Splunk Cloud Platform allows low-privileged users - those without the 'admin' or 'power' roles - to retrieve stored credential hashes by issuing the |rest SPL command against the /servicesNS/-/-/storage/passwords endpoint, which incorrectly returns the encr_password field. Affected are Splunk Enterprise branches below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and multiple Splunk Cloud Platform versions. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV, but the real-world impact is significant wherever Splunk stores credentials for external services such as databases, APIs, or cloud accounts.
Technical ContextAI
Splunk's Search Processing Language (SPL) includes the |rest command, which allows users to proxy HTTP requests to internal Splunk REST API endpoints from within a search job. The /servicesNS/-/-/storage/passwords endpoint is the Splunk credential vault, used by apps and searches to store and retrieve sensitive credentials for external integrations. The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) is that the |rest command fails to strip the encr_password field from the API response before surfacing results to the searching user, bypassing the role-based access controls that ordinarily gate direct REST API access to this endpoint. Affected CPEs are cpe:2.3:a:splunk:splunk_enterprise and cpe:2.3:a:splunk:splunk_cloud_platform, covering both self-hosted and cloud-managed deployments.
RemediationAI
Upgrade Splunk Enterprise to version 10.4.1, 10.2.5, 10.0.8, or 9.4.13 in the respective maintenance branch; upgrade Splunk Cloud Platform to 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, or 10.1.2507.24 in the respective branch. Refer to the vendor advisory SVD-2026-0704 at https://advisory.splunk.com/advisories/SVD-2026-0704 for patching confirmation. As a compensating control prior to patching, administrators may restrict access to the |rest SPL command by limiting it to the 'admin' or 'power' roles via role-based capability settings; however, this may break apps or scheduled searches that use |rest legitimately, so inventory |rest usage before restricting. Additionally, audit the credential store and remove any credentials whose exposure would pose critical downstream risk, prioritizing removal of cloud provider keys or database root credentials.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today