Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated requests to internal Splunk services, which could allow for changes to Search Head Cluster state and a denial of service. The vulnerability is possible because Splunk Secure Gateway does not validate report notification path values before it sends internal requests.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected products
- Splunk / splunk9.4.0 – 9.4.14
- Splunk / Splunk Enterprise10.0 – 10.0.9
- Splunk / Splunk Enterprise9.4 – 9.4.14
- Splunk / Splunk Enterprise10.4 – 10.4.2
- Splunk / Splunk Enterprise10.2 – 10.2.6
- Splunk / Splunk Secure Gateway3.8.0 – 3.8.70
- Splunk / Splunk Secure Gateway3.10 – 3.10.9
- Splunk / Splunk Secure Gateway3.9 – 3.9.23
- Splunk / Splunk Secure Gateway3.8 – 3.8.70
References
- VENDOR_ADVISORYhttps://advisory.splunk.com/advisories/SVD-2026-0801
Updated 4m ago · 8 sources