EUVD-2026-63114
GHSA-9m2v-75c6-7v47
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Splunk 10.4.x host on network
-
ExploitLocate sidecar Prometheus metrics port
-
ExecutionSend unauthenticated HTTP GET request
-
ImpactRetrieve runtime and build metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network-level reachability to the Prometheus metrics endpoint of the Edge Processor SPL2 Preview sidecar on a Splunk Enterprise 10.4.0 or 10.4.1 instance. The sidecar must be running, which occurs when the Edge Processor SPL2 Preview feature is active. No authentication, no prior access, and no user interaction are required once network access to the sidecar port exists. Exploitation is limited to environments running the 10.4 line specifically - Splunk Enterprise below 10.4 is explicitly unaffected. Deployments where the sidecar port is firewalled or not externally exposed face substantially reduced risk. |
| Impact | The vendor-assigned CVSS score of 7.5 (C:H) reflects a worst-case framing of the confidentiality impact. Independently assessed, the disclosed data - runtime and build metadata from a sidecar process - is most accurately categorized as low-to-medium confidentiality impact: it aids attacker reconnaissance (version fingerprinting, internal service topology) but does not directly expose credentials, user data, or search results. No KEV listing exists and no public exploit code has been identified, which substantially lowers real-world urgency compared to the headline score. EPSS data is not present in the source intelligence. The practical risk is that version and runtime details could accelerate a follow-on attack against a known Splunk vulnerability, making this most consequential in environments where Splunk Enterprise 10.4.x sidecars are network-exposed without perimeter controls. Any operator running 10.4.x should treat this as a routine patch priority rather than an emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to a Splunk Enterprise 10.4.x host sends a plain HTTP GET request to the Prometheus metrics endpoint on the Edge Processor SPL2 Preview sidecar. The sidecar returns all available metrics without requesting credentials, exposing runtime environment details such as Go version, sidecar build version, and service identifiers that the attacker can use to fingerprint the deployment and identify version-specific follow-on attack paths. No public exploit code has been identified at time of analysis, making exploitation straightforward given only network access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Unauthenticated information disclosure in Splunk Enterprise 10.4.x exposes Prometheus service metrics from the Edge Processor SPL2 Preview sidecar to any network-reachable client. The sidecar's Prometheus metrics endpoint lacks authentication, allowing retrieval of runtime and build metadata without credentials. No public exploit code has been identified at time of analysis, and the vulnerability does not affect Splunk Enterprise versions below 10.4.
RemediationAI
Upgrade Splunk Enterprise to version 10.4.2 or later, which addresses the missing authentication on the Prometheus metrics endpoint per the vendor advisory at https://advisory.splunk.com/advisories/SVD-2026-0801. If immediate patching is not feasible, restrict network access to the sidecar's Prometheus metrics port using host-based firewall rules or network ACLs so that only authorized monitoring infrastructure can reach it; this removes the unauthenticated-remote-access condition without disabling the sidecar's functionality. Note that firewall controls are a compensating measure only - they do not fix the underlying authentication gap and should not substitute for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Splunk Enterprise 10.4 introduced an Edge Processor SPL2 Preview sidecar - a companion process (CPE: cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*) that runs alongside the main Splunk instance to support next-generation SPL2 processing. This sidecar embeds a Prometheus metrics HTTP endpoint, a standard observability interface used to expose operational telemetry. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) applies here: the root cause is the complete absence of authentication middleware on the Prometheus endpoint, a common misconfiguration in sidecar architectures where internal telemetry endpoints are mistakenly assumed to be network-isolated but are in fact reachable by broader network clients.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, no auth required, no interaction; confidentiality rated Low because only runtime/build metadata is disclosed, not credentials or user data.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterprise versions below 10.4. The information disclosure is possible because the Prometheus metrics endpoint in the Edge Processor SPL2 Preview sidecar lacks authentication, which lets any client that can reach the sidecar retrieve the metrics without credentials. For more information see About Splunk sidecars (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/about-splunk-sidecars) in the Splunk documentation.
Executive ViewAI
Splunk Enterprise 10.4.x deployments with the Edge Processor Preview component contain an unauthenticated information disclosure vulnerability exposing system metrics and metadata to any network-reachable attacker without requiring credentials. This reconnaissance capability significantly lowers barriers to initial attack planning and targeting of affected organizations. Immediate network access controls and upgrade planning are required to mitigate reconnaissance risk.
Restrict network access to the Prometheus metrics endpoint via firewall rules and network segmentation to only authorized internal systems; implement reverse proxy authentication enforcement in front of the metrics endpoint; disable the Edge Processor Preview sidecar if not operationally required; implement continuous monitoring and alerting on access attempts to the metrics endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB