EUVD-2026-62905
GHSA-9mp7-pwvh-jcpg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
REST API is network-accessible without credentials (AV:N, PR:N, AC:L); impact is limited to forcing a key reload with no data exposure or service crash (I:L, C:N, A:N).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer (REST) API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because the REST API does not require authentication or the change_authentication capability for the token-key reload action. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
AnalysisAI
Unauthenticated token-signing key reload in Splunk Enterprise 10.4.x (below 10.4.2) exposes a REST API endpoint that lacks the required change_authentication capability check, permitting any network-reachable caller to force a key reload cycle without credentials. The flaw is classified under CWE-862 (Missing Authorization) and was reported by Cisco; a vendor patch is available at 10.4.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable endpoint is the token-key reload action within the Splunk Enterprise REST API, which is exposed by default on TCP port 8089. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium rating (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects a low-complexity, unauthenticated network-exploitable flaw with limited integrity impact - the attacker influences system state (forces a key reload) rather than directly exfiltrating data or executing code. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker with network access to the Splunk Enterprise REST API port (default 8089) sends a crafted HTTP request targeting the token-key reload action. Because the endpoint enforces no authentication or capability check, the request succeeds, triggering a token-signing key refresh cycle. … |
| Remediation | Vendor-released patch: Splunk Enterprise 10.4.2, which addresses the missing authorization check on the token-key reload REST endpoint; upgrade instructions and release notes are available at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today