This vulnerability in Splunk Enterprise and Splunk Cloud Platform arises from insufficient verification of request authenticity and improper input neutralization in Deployment Server endpoints. Specifically, CSRF tokens are not validated on GET requests, enabling an attacker to coerce a user with the list_deployment_server capability to run arbitrary SPL queries as splunk-system-user. This can lead to unauthorized access to stored credentials and indexed data. The affected versions include Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24. No official remediation level or patch information is provided in the source data.

Successful exploitation allows an attacker to execute arbitrary SPL searches as the splunk-system-user by tricking a user with the list_deployment_server capability. This can lead to unauthorized disclosure of stored credentials and indexed data, impacting confidentiality and integrity. The vulnerability has a high CVSS score of 8.3, indicating a significant security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict roles with the list_deployment_server capability to trusted users only and monitor for suspicious activity related to SPL search execution. Avoid clicking on untrusted links that could trigger malicious GET requests. Follow any additional guidance from Splunk's official security advisories.