In affected versions of Splunk Enterprise and Splunk Cloud Platform, the Dashboard Studio PDF export feature does not sufficiently validate URLs requested from upstream components. The trusted-domain validation relies on a prefix match vulnerable to subdomain bypass (e.g., docs.splunk.com.evil.com). Additionally, the PDF export service automatically follows HTTP redirects without re-checking the redirect targets against the allowlist. This enables low-privileged users lacking admin or power roles to perform server-side request forgery (SSRF) to arbitrary internal destinations.

An attacker with low privileges can exploit this vulnerability to make the Splunk server send requests to arbitrary internal network destinations. This can lead to unauthorized access to internal resources, potential data leakage, and partial service disruption. The CVSS score of 7.6 indicates high severity with high confidentiality impact, low integrity impact, and low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Dashboard Studio PDF export feature to trusted users only and monitor for unusual internal request patterns. Avoid exposing Splunk instances to untrusted networks. Follow vendor advisories closely for updates on patches or official mitigations.