Splunk Enterprise EUVD-2026-62905

The vulnerable endpoint is the token-key reload action within the Splunk Enterprise REST API, which is exposed by default on TCP port 8089. No authentication, no capability, and no special configuration are required - the flaw exists in the default deployment of affected 10.4.x versions because the authorization check is entirely absent from this endpoint rather than misconfigured. Exploitation is limited to Splunk Enterprise 10.4.0 and 10.4.1 specifically; all versions below 10.4 are confirmed not affected. The attacker must have network-layer access to the REST API port, meaning instances protected by firewall rules restricting port 8089 to management networks have significantly reduced exposure. No user interaction and no attacker-controlled prerequisite configuration are required.

The CVSS 5.3 Medium rating (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects a low-complexity, unauthenticated network-exploitable flaw with limited integrity impact - the attacker influences system state (forces a key reload) rather than directly exfiltrating data or executing code. No EPSS score was supplied in the input data and cannot be independently confirmed here. There is no CISA KEV listing and no known public POC at time of analysis. Even a mid-sized IT team in bytom operating a Splunk Enterprise 10.4 deployment should treat this as a moderate operational priority given the zero-barrier exploitation path (PR:N, AC:L) against a security-sensitive component: forcing token-signing key reloads could interrupt active authenticated sessions or disrupt downstream token validation in federated environments. The scope is meaningfully constrained - only the 10.4.x branch below 10.4.2 is affected; all earlier major versions are explicitly not vulnerable per the vendor advisory, which limits the exposed population. The primary risk amplifier is that Splunk Enterprise's REST API is sometimes exposed on internal networks without strict firewall segmentation, making the endpoint reachable to a broad set of internal actors.

An unauthenticated attacker with network access to the Splunk Enterprise REST API port (default 8089) sends a crafted HTTP request targeting the token-key reload action. Because the endpoint enforces no authentication or capability check, the request succeeds, triggering a token-signing key refresh cycle. In environments where Splunk tokens are actively used for inter-service authentication or API access, this could invalidate in-flight tokens and disrupt dependent integrations or monitoring pipelines.