EUVD-2026-94628
GHSA-2fgh-wj5r-jjc6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Splunk user
-
ExploitLoad Discover Observability Cloud app in Splunk Web
-
ExecutionRetrieve embedded source maps from JS bundles
-
ImpactReconstruct original application source code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V13 - Configuration Secure default settings
|
| Exploitation Conditions | Requires an authenticated Splunk account (PR:L) that does NOT hold the 'admin' or 'power' roles, plus access to Splunk Web and the presence/accessibility of the Discover Splunk Observability Cloud app whose production JavaScript bundles contain embedded source maps. Limiting factors: exploitation is confined to Splunk Enterprise versions 10.4.x <10.4.3, 10.2.x <10.2.7, and 10.0.x <10.0.10 (9.4.x is not affected), demands valid authentication rather than anonymous access, and is only relevant where the affected Observability Cloud app is installed and reachable by the low-privileged user. Impact is limited to disclosure of the app's own source code - no data modification or service disruption. |
| Impact | This is a genuinely low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 MEDIUM) accurately reflects a limited-confidentiality-only flaw: an authenticated, low-privileged user (not holding 'admin' or 'power' roles) can retrieve original application source code because production JavaScript bundles for the Discover Splunk Observability Cloud app ship with embedded source maps. There is no integrity or availability impact and no privilege escalation - the disclosed asset is the app's own source, not customer data, credentials, or indexed events. No EPSS score was provided in the input, and the CVE is NOT on CISA KEV; no POC is referenced. All signals are consistent with each other: a medium-CVSS, authentication-required, information-disclosure weakness with no indication of exploitation. The practical risk is limited to aiding reconnaissance (an insider or compromised low-priv account could study the source to hunt for further flaws) rather than direct compromise. Missing data to note: EPSS probability is absent (cannot quantify exploitation likelihood), and no independent POC/exploitation telemetry was supplied - these are absences, not conflicts. CWE-1188 (insecure default resource initialization) aligns with the root cause of source maps being left enabled in a production build by default. |
| Exploit ScenarioDerived | A low-privileged Splunk user with no admin/power role logs into Splunk Web and loads the Discover Splunk Observability Cloud app, whose production JavaScript bundles include embedded source maps. By retrieving those source maps through the browser, the user reconstructs the app's original, unminified source code - potentially revealing internal logic, endpoints, or hints for further attacks. No public exploit code is identified at time of analysis, and no special tooling is required beyond normal authenticated access to Splunk Web. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Low-privileged Splunk Enterprise users can retrieve the original source code of the Discover Splunk Observability Cloud app because production JavaScript bundles shipped with the app retain embedded source maps. The issue affects Splunk Enterprise below 10.4.3, below 10.2.7, and below 10.0.10 (10.0.x, 10.2.x, and 10.4.x branches); the 9.4.x line is explicitly not affected. Exploitation requires an authenticated account that does not hold the 'admin' or 'power' roles plus access to Splunk Web and the presence of the affected app, and the resulting disclosure is confined to the app's own source code with no integrity or availability impact; no public exploit has been identified at time of analysis, and vendor fixes are available.
RemediationAI
Vendor-released patch: upgrade Splunk Enterprise to 10.4.3, 10.2.7, or 10.0.10 (whichever corresponds to your release train) per Splunk advisory SVD-2026-1001 (https://advisory.splunk.com/advisories/SVD-2026-1001); after upgrading, clear any cached copies of previously served source maps at the reverse-proxy/CDN and flush user browser caches so stale .map artifacts are not retained. Where an immediate upgrade is not possible, the most direct compensating control is to block or 404 requests for JavaScript source-map artifacts (URIs ending in .map, and any sourceMappingURL targets) at the web tier or reverse proxy in front of Splunk Web; the trade-off is that this also breaks legitimate developer debugging in browsers, and it must be applied consistently across every front end or the exposure simply moves. A second option is to restrict visibility of the Discover Splunk Observability Cloud app - remove it from the app allow-list of low-privileged roles or uninstall it on instances that do not use Splunk Observability Cloud previews - with the trade-off that users who legitimately need the app lose that functionality. Because the assessed impact is confidentiality-only (no integrity or availability effect), no additional memory-safety or service-hardening mitigations are indicated, and the CVSS vector indicates no anonymous exposure, so requiring valid authentication for all Splunk Web access remains a baseline prerequisite rather than a sufficient fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in a build-packaging defect in the Discover Splunk Observability Cloud app rather than in Splunk's core platform code: production JavaScript bundles were published with their attached source maps (typically .js.map files referenced by sourceMappingURL comments), so a browser or any HTTP client can fetch the map and reconstruct the original, unminified source. This is tracked as CWE-1188 (Insecure Default Initialization of Resource), i.e., a deployment/build artifact was left in its developer-oriented default state instead of a hardened production configuration. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N describes the practical reality well: the resource is reachable over the network through Splunk Web, no user interaction is needed, the attacker must already hold a valid low-privileged Splunk account (PR:L, any role other than 'admin' or 'power'), scope remains unchanged, and the only consequence is low-confidentiality exposure of the app's own code. Notably, this is an information-exposure-through-source-code class of defect, so there is no memory-safety, injection, or privilege-escalation primitive involved - the artifact published by the vendor is simply richer than it should have been. The affected CPE set is cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*, narrowed by the vendor to the 10.0.x, 10.2.x, and 10.4.x release trains.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploited over Splunk Web (AV:N) by any authenticated low-privileged user (PR:L) with no interaction; only app source code is disclosed, so C:L and I/A:N.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production JavaScript bundles for the app contain embedded source maps that include original source code. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), Splunk Observability Cloud previews (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/observability/splunk-observability-cloud-previews), and Navigating Splunk Web (https://help.splunk.com/en/splunk-enterprise/search/search-tutorial/10.4/part-1-getting-started/navigating-splunk-web) in the Splunk documentation.
Splunk Enterprise versions 9.4.x are not affected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB