EUVD-2026-63110
GHSA-3mh4-7c3j-c9mg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Scope changed to C because the confidentiality impact falls on other users' tokens, crossing the security boundary of the exploiting account; PR:L confirmed by the description's explicit 'non-admin, non-power user' framing.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile user requests, including tokens that compromise all relevant data available to the affected mobile user, to an attacker-controlled Uniform Resource Locator (URL). The vulnerability is possible because a hard-coded cryptographic key in the Splunk Secure Gateway companion app registration handler allows for arbitrary callback URL registration without restriction. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
AnalysisAI
Splunk Secure Gateway's companion app registration handler contains a hard-coded cryptographic key, enabling any low-privileged authenticated Splunk user - explicitly excluding admin or power roles - to register an arbitrary attacker-controlled callback URL and cause Secure Gateway to forward mobile user requests and authentication tokens to that URL. Affected are Splunk Enterprise branches 9.4 (below 9.4.14), 10.0 (below 10.0.9), 10.2 (below 10.2.6), and 10.4 (below 10.4.2), alongside Splunk Secure Gateway branches 3.8 (below 3.8.71), 3.9 (below 3.9.24), and 3.10 (below 3.10.10). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Splunk session held by any standard user account - the CVE description explicitly states that users who do NOT hold the 'admin' or 'power' roles are the threat actors, meaning the lowest tier of Splunk user is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network-accessible exploitation by any low-privileged authenticated user with no user interaction required and high confidentiality impact through token theft. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding any low-privileged Splunk account (e.g., a read-only analyst or compromised service account) authenticates to Splunk and sends a crafted companion app registration request to the Splunk Secure Gateway endpoint, exploiting the hard-coded cryptographic key to register an attacker-controlled HTTPS server as a callback URL. Once registered, all subsequent mobile authentication requests from legitimate Splunk Mobile users are transparently forwarded - including their session tokens - to the attacker's server, granting the attacker access to all Splunk data and capabilities available to those mobile users without triggering any further authentication challenge. … |
| Remediation | The primary fix is to upgrade Splunk Enterprise to version 9.4.14, 10.0.9, 10.2.6, or 10.4.2 (or later within each respective branch), and Splunk Secure Gateway to version 3.8.71, 3.9.24, or 3.10.10 (or later), per the vendor advisory at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allShare
External POC / Exploit Code
Leaving vuln.today