In Splunk Enterprise 10.4 versions below 10.4.2, the Prometheus metrics endpoint in the Edge Processor SPL2 Preview sidecar does not require authentication. This allows unauthenticated remote attackers to read service metrics, including runtime and build metadata, potentially exposing sensitive information about the sidecar. The vulnerability is classified as CWE-200 (Information Exposure). It does not affect versions prior to 10.4. The CVSS 3.1 score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact.

An unauthenticated attacker can remotely access sensitive Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, exposing runtime and build metadata. This information disclosure could aid attackers in understanding the environment and potentially facilitate further attacks. There is no impact on integrity or availability. Versions prior to 10.4 are not affected.

A fix is available in Splunk Enterprise version 10.4.2. Users should upgrade to version 10.4.2 or later to remediate this vulnerability. Since the vulnerability is due to lack of authentication on the Prometheus metrics endpoint, applying the official update is the recommended mitigation. No other vendor advisories or temporary mitigations are provided. Patch status is not explicitly confirmed in the input data, so verify with Splunk's official advisory for current remediation guidance.