EUVD-2026-62920
GHSA-g8fg-v59g-8cmc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Splunk instance with port 8089 open
-
DeliveryConfirm Edge Processor feature is enabled
-
ExploitSend unauthenticated HTTP GET to pipeline configuration endpoint
-
ExecutionReceive and parse pipeline configuration response
-
ImpactExtract routing rules, destinations, and field logic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Edge Processor feature is explicitly enabled in Splunk Enterprise - it is not active by default. Only Splunk Enterprise 10.4.0 and 10.4.1 are vulnerable; versions before 10.4 do not include the feature and are not affected. Given CVSS PR:N/UI:N, no credentials or user interaction are required once the feature is on. Limiting factors: the non-default Edge Processor configuration significantly reduces the exposed population; the impact is limited to confidentiality (read-only access to pipeline configuration data, not arbitrary data or credential theft); and network-layer controls on the REST API port can reduce but not eliminate exposure. |
| Impact | The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 7.5 and is consistent with the description: the attack is network-accessible, requires no authentication, no user interaction, and yields high confidentiality impact with no integrity or availability loss. The primary limiting factor is that Edge Processor must be explicitly enabled - it is not on by default in Splunk Enterprise - which materially narrows the exposed population relative to the raw CVSS score. No EPSS data was provided in the source intelligence; no CISA KEV listing or public POC is noted. SSVC signals are moderate: exploitation is theoretically automatable given PR:N/AC:L, but the non-default configuration prerequisite reduces realistic at-scale scanning yield. Real-world priority for organizations not running Edge Processor is low; for those who are, this is a meaningful disclosure risk given the sensitivity of pipeline configuration data. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to the Splunk REST API port (typically 8089) issues an HTTP GET request to the Edge Processor pipeline configuration endpoint. The server returns the full pipeline configuration in the response body, disclosing routing rules, field extraction logic, and downstream destination addresses - information the attacker can use to map the organization's data pipeline topology or identify high-value data flows for further targeting. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Unauthenticated remote disclosure of Edge Processor pipeline configurations in Splunk Enterprise 10.4.x exposes potentially sensitive data-processing logic to any network-accessible attacker. The REST API endpoint serving Edge Processor configuration lacks authentication controls (CWE-306), meaning any unauthenticated actor can retrieve pipeline details when the Edge Processor feature is enabled. No public exploit code has been identified at time of analysis, and the flaw is restricted to the 10.4.x branch - prior versions are unaffected.
RemediationAI
Upgrade to Splunk Enterprise 10.4.2 or later, which introduces authentication controls on the Edge Processor REST API endpoint per Splunk advisory SVD-2026-0801 (https://advisory.splunk.com/advisories/SVD-2026-0801). As a compensating control for organizations unable to patch immediately, disabling the Edge Processor feature entirely removes the vulnerable endpoint from the attack surface; however, this sacrifices edge data-processing capability. Network-layer controls - restricting REST API access (default port 8089) to trusted management networks via firewall or host-based ACLs - can reduce exposure but do not remediate the underlying missing authentication flaw and may not account for all internal adversaries. There is no workaround that preserves Edge Processor functionality without patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Splunk Enterprise's Edge Processor is an optional component that enables data processing closer to the source before ingestion into Splunk, exposing its own REST API surface for pipeline management (documented at help.splunk.com under 'System architecture of the Edge Processor solution'). The affected CPE is cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* scoped to version 10.4.0 through 10.4.1. The root cause is CWE-306 (Missing Authentication for Critical Function): the Edge Processor service endpoint was introduced in 10.4 without enforcing authentication checks on configuration-retrieval requests. Pipeline configurations may contain field extractions, routing rules, data transformation logic, and destination endpoints - information that could aid an attacker in understanding data flows, identifying high-value targets, or crafting further attacks against downstream systems.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible REST endpoint with no auth required; high confidentiality impact from config disclosure; no integrity or availability effect confirmed by description.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer (REST) API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulnerability exists because the Edge Processor service endpoint lacks authentication controls. For more information see System architecture of the Edge Processor solution (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/how-the-edge-processor-solution-works/system-architecture-of-the-edge-processor-solution) in the Splunk documentation.
Executive ViewAI
Splunk Enterprise 10.4.x contains an unauthenticated remote information disclosure vulnerability in its Edge Processor REST API endpoint, allowing any network-accessible attacker to retrieve sensitive data-processing pipeline configurations without credentials. Organizations running affected versions with Edge Processor enabled risk exposure of operational data transformation logic that could inform further targeted attacks. Immediate assessment and patching of 10.4.x deployments is required to prevent configuration compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB