Splunk Enterprise EUVD-2026-44738

Exploitation requires: (1) a valid Splunk user account that does NOT hold the 'admin' or 'power' role - any other authenticated user is potentially affected; (2) permission to run SPL searches, including the |rest command, on the Splunk instance; and (3) the presence of at least one credential entry in the Splunk passwords store (i.e., an app or manual entry must have stored credentials via this endpoint). Exploitation is bounded by PR:L (an active Splunk account is mandatory - anonymous or unauthenticated access is not possible) and AC:H (the attacker must know to query this specific endpoint path via |rest rather than a direct REST call, which would be blocked by role controls). Users already holding the 'admin' or 'power' roles have legitimate access to this data, so they are not an attack path - only users below those privilege tiers are the relevant attacker population.

The official CVSS 3.1 score of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly captures the high confidentiality impact against a constrained attack surface. AC:H reflects that exploitation requires specific knowledge of the |rest SPL mechanism and the passwords endpoint path - this is not a trivially discoverable or automatable attack for uninformed users. PR:L means a valid, non-privileged Splunk account is required, limiting the attack surface to authenticated insiders or compromised low-privilege accounts. No EPSS data was provided; exploitation probability is unconstrained by that signal. No CISA KEV listing and no identified POC reduce immediate urgency, but the severity of what is exposed - credential hashes that may be crackable or replayable - means real-world impact can exceed the CVSS numeric score. Environments storing high-value credentials (cloud API keys, database passwords) in the Splunk vault face elevated downstream risk if these hashes are obtained.

A low-privileged Splunk user with search access opens a Splunk search window and executes | rest /servicesNS/-/-/storage/passwords, receiving JSON results that include the encr_password field containing stored credential hashes. The attacker exports these hashes and attempts offline cracking or, if the scheme permits, direct replay against the target external service for which the credential was stored.