In Splunk Enterprise 10.4 versions below 10.4.2, the Edge Processor service endpoint lacks authentication controls, allowing unauthenticated users to retrieve sensitive information contained in Edge Processor pipeline configurations through a REST API endpoint when Edge Processor is enabled. This vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). It affects only versions starting from 10.4 up to but not including 10.4.2. No known exploits in the wild have been reported. The vulnerability does not impact versions prior to 10.4.

An unauthenticated attacker can access sensitive configuration information of the Edge Processor pipelines, potentially exposing internal processing details. The vulnerability does not allow modification or denial of service but results in a confidentiality breach. This could aid attackers in further reconnaissance or targeted attacks against the affected Splunk deployment.

A fix is available in Splunk Enterprise version 10.4.2. Users should upgrade to version 10.4.2 or later to remediate this vulnerability. Until patched, disabling the Edge Processor feature or restricting access to the REST API endpoint may reduce exposure. Patch status is not explicitly confirmed in the provided data; users should verify the vendor advisory for the latest remediation guidance.