EUVD-2026-63103
GHSA-3pfp-cpmw-f74j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
REST endpoints are network-reachable; any authenticated Splunk user qualifies (PR:L); missing capability check exposes stored credential with high confidentiality and low integrity impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored for the app. With this access, the user could view all relevant data available to that token and make limited changes to Splunk Observability Cloud content. The vulnerability does not affect Splunk Enterprise 9.4 and 9.3 versions. The vulnerability is possible because the app's Representational State Transfer (REST) API endpoint handlers do not enforce the read_o11y_content capability before forwarding requests with the stored access token. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
AnalysisAI
Missing authorization in the Splunk App for Splunk Observability Cloud exposes a stored Observability Cloud access token to any authenticated Splunk user lacking the admin or power role. Affected versions of Splunk Enterprise (below 10.4.2, 10.2.6, and 10.0.9) ship REST API endpoint handlers in the Observability Cloud integration app that fail to enforce the read_o11y_content capability before proxying requests - and the stored token - to Splunk Observability Cloud. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must all be true: (1) Splunk Enterprise must be running a 10.x release below the fixed versions (10.4.2, 10.2.6, or 10.0.9) - Splunk 9.3 and 9.4 are explicitly exempt; (2) the Splunk App for Splunk Observability Cloud must be installed and configured with a valid Observability Cloud access token; (3) the attacker must hold a valid Splunk account that does NOT have the admin or power role - low-privileged authenticated access is both sufficient and required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N scores 7.1 (High), which reflects the real-world risk well. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Splunk user assigned a basic analyst or viewer role - deliberately excluded from admin and power roles - sends a crafted HTTP request to one of the Splunk App for Splunk Observability Cloud's REST API endpoints on the Splunk Enterprise server. The endpoint handler, lacking a capability gate, immediately proxies the request to Splunk Observability Cloud using the app's stored API access token, returning Observability Cloud data (dashboards, metrics, traces) to the attacker and allowing limited content modifications. … |
| Remediation | The primary fix is to upgrade Splunk Enterprise to version 10.4.2, 10.2.6, or 10.0.9 (choosing the release branch that matches the current deployment). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Splunk Enterprise deployments to identify instances running versions prior to 10.4.2, 10.2.6, and 10.0.9, and immediately restrict access to the Observability Cloud integration app to admin and power-user roles only via Splunk role-based access controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today