This vulnerability affects Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, as well as Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24. It arises from insufficient verification of whether a request was intentionally provided by the user, specifically due to missing CSRF token validation on GET requests to Deployment Server endpoints and improper input neutralization before inclusion in SPL searches. An attacker can leverage this to execute arbitrary SPL searches as the splunk-system-user via a user with the list_deployment_server capability, potentially accessing stored credentials and indexed data.

Successful exploitation allows an attacker to perform arbitrary SPL searches as the splunk-system-user by tricking a privileged user, leading to unauthorized access to sensitive stored credentials and indexed data. The CVSS 3.1 base score is 8.3 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality and integrity impact with low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict roles with the list_deployment_server capability to trusted users only and monitor for suspicious activity involving SPL searches. Avoid clicking on untrusted links that could trigger GET requests to Deployment Server endpoints.