In affected Splunk Enterprise versions, a user lacking admin or power roles can induce another user to run arbitrary Search Processing Language (SPL) commands through the Data Model Editor. The root cause is that Splunk Web does not enforce SPL safeguards for risky commands during base searches for auto-extracted fields. The vulnerability requires user interaction via phishing to trigger the execution of these commands under the victim's permissions, potentially exposing data and impacting system integrity.

An attacker with limited privileges can leverage this vulnerability to execute arbitrary SPL commands with the permissions of a targeted user who has higher privileges. This can lead to unauthorized access to data available to the victim user and compromise system integrity. The vulnerability does not allow privilege escalation by itself but relies on tricking a user with higher privileges to execute commands.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, mitigate risk by educating users to recognize phishing attempts and restrict the use of the Data Model Editor to trusted users. Review and enforce strict role definitions and capabilities to limit exposure. Monitor Splunk documentation for updates on SPL safeguards and apply official patches once released.