This vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, allows users without admin or power roles to exploit SSRF through report notifications. The SSRF flaw permits sending system-authenticated requests to internal services, which can lead to unauthorized changes in Search Head Cluster state and denial of service. The root cause is insufficient validation of report notification path values by Splunk Secure Gateway.

An attacker with limited privileges (not holding admin or power roles) can exploit this SSRF vulnerability to send authenticated requests internally, potentially modifying Search Head Cluster state and causing denial of service. There is no confidentiality impact reported. The CVSS score is 5.4 (medium severity), reflecting low complexity and limited privileges required but no confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary fix information is provided in the available data. Users should monitor the vendor advisory for updates and apply patches once available. Until then, restrict access to report notification features to trusted users and consider limiting network access to internal Splunk services to reduce risk.