EUVD-2026-94623
GHSA-pf4p-427j-r97p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Splunk user
-
DeliveryReach Observability Cloud app REST endpoint
-
ExploitSubmit crafted input triggering inefficient regex
-
ExecutionCatastrophic backtracking exhausts CPU
-
ImpactDenial of service for REST API
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Requires an authenticated Splunk account that does NOT need the 'admin' or 'power' roles - any low-privileged user suffices (PR:L). The specific vulnerable surface is the REST API endpoint of the 'Discover Splunk Observability Cloud app', which the vendor documents as a preview feature; exploitation presupposes this app/endpoint is present and reachable, so environments without the Observability Cloud preview enabled are not exposed. Exploitation is limited to affected 10.x branches (10.4.x below 10.4.3, 10.2.x below 10.2.7, 10.0.x below 10.0.10); version 9.4.x is explicitly not affected. No user interaction is required (UI:N) and impact is confined to availability (DoS via inefficient-regex CPU exhaustion), with no data exposure or modification. |
| Impact | This is a moderate-priority, availability-only vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly scores it 6.5 MEDIUM: network-reachable with low attack complexity, but it requires an authenticated low-privileged account (PR:L) and yields only a denial of service (A:H) with no confidentiality or integrity impact. The root cause is CWE-407 (algorithmic complexity / inefficient regular expression, i.e. a ReDoS) in input validation for a REST API endpoint, so a crafted input can pin CPU and starve the service. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public exploit was supplied - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (authenticated, DoS-only), with no CVSS-vs-description conflict. The main caveat is exposure scope: the flaw lives in the 'Discover Splunk Observability Cloud app', described as a preview feature, so real-world impact depends on whether that app/endpoint is actually enabled, which likely narrows exposure well below the full Splunk Enterprise install base. |
| Exploit ScenarioDerived | An attacker who already holds a basic, non-admin/non-power Splunk account (or who compromises such low-privileged credentials) sends a specially crafted input to the REST API endpoint exposed by the Discover Splunk Observability Cloud app. Because the endpoint validates input with an inefficient regular expression, the request triggers catastrophic backtracking that consumes CPU and degrades or halts the service for other users. No public proof-of-concept was provided, and exploitation is remote (AV:N) with low complexity but requires valid authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Denial of service in Splunk Enterprise 10.x allows an authenticated user with only low-privileged roles to degrade or take down a REST API endpoint exposed by the Discover Splunk Observability Cloud app, because the app validates input with an inefficient regular expression that can be driven into excessive CPU consumption. Affected branches are 10.4.x below 10.4.3, 10.2.x below 10.2.7, and 10.0.x below 10.0.10; Splunk Enterprise 9.4.x is explicitly not affected, and the exposure only exists where the Observability Cloud preview app and its endpoint are present and reachable. Impact is confined to availability (no data disclosure or modification), no public exploit code has been identified at time of analysis, and the vendor has released fixes in 10.4.3, 10.2.7, and 10.0.10.
RemediationAI
Vendor-released patch: upgrade Splunk Enterprise to 10.4.3, 10.2.7, or 10.0.10 according to your release train, as documented in the Splunk advisory SVD-2026-1001 (https://advisory.splunk.com/advisories/SVD-2026-1001). Until upgrading is possible, the most direct compensating control is to remove the attack surface: disable or uninstall the Discover Splunk Observability Cloud app preview, or otherwise restrict its REST endpoint from ordinary authenticated users via role-based access configuration; the trade-off is loss of the observability preview functionality for those users. If the feature must stay available, restrict the endpoint to a small set of trusted accounts using Splunk's role and capability configuration (the vulnerable path only requires the low privileges available to non-admin, non-power users, so narrowing who can reach it materially reduces exposure), and apply network or reverse-proxy filtering so the endpoint is not reachable from untrusted networks. Because exploitation manifests as CPU exhaustion, additionally monitor for abnormal CPU spikes and repeated requests to the Observability Cloud REST endpoints as a detection control rather than a prevention control. Note that 9.4.x installations require no action for this specific issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-407 (Inefficient Regular Expression Complexity): the Discover Splunk Observability Cloud app applies a poorly bounded regular expression to validate input submitted through one of its Representational State Transfer (REST) API endpoints, so crafted input can force excessive backtracking and consume disproportionate CPU. Splunk Enterprise exposes such endpoints declaratively through restmap.conf, and authorization is governed by Splunk's role-based access control model, which is why a low-privileged account that holds neither the 'admin' nor the 'power' role is sufficient - the endpoint is reachable to ordinary authenticated users. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms the attacker is network-capable, requires low privileges, needs no user interaction, and achieves only high availability impact within the same security scope. The CPE cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* is a broad wildcard, but the EUVD affected-version enumeration and the advisory narrow the real exposure to the 10.4, 10.2, and 10.0 release trains. Because the vulnerable surface belongs to a preview feature (Observability Cloud previews), deployments that never enabled or exposed that app are not on the attack path.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Remote REST endpoint (AV:N) with low complexity reachable by any authenticated low-privileged user (PR:L); ReDoS yields availability-only impact (A:H, C:N/I:N).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer (REST) API endpoint in the Discover Splunk Observability Cloud app. The vulnerability is possible because the app uses an inefficient regular expression to validate input submitted through the endpoint. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), Splunk Observability Cloud previews (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/observability/splunk-observability-cloud-previews), and restmap.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/restmap.conf) in the Splunk documentation.
Splunk Enterprise versions 9.4.x are not affected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB