In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user holding a Splunk role with permissions to list storage passwords but lacking Secure Gateway administration privileges can access Mobile Device Management signing secrets. The vulnerability arises because the Splunk Secure Gateway REST API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Secure Gateway administration privileges before processing requests. This improper privilege enforcement allows unauthorized access to sensitive signing secrets that could compromise all affected mobile-device enrollment trust through Splunk Secure Gateway.

An attacker with limited permissions (ability to list storage passwords) but without Secure Gateway admin rights can access sensitive Mobile Device Management signing secrets. This exposure compromises the trust model for mobile-device enrollment managed via Splunk Secure Gateway, potentially allowing unauthorized enrollment or manipulation of mobile devices within the affected environment. The vulnerability does not impact integrity or availability directly but results in a high confidentiality impact for sensitive secrets.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict roles that have permissions to list storage passwords to trusted users only. Monitor vendor communications for updates on patches addressing this privilege enforcement issue in the Splunk Secure Gateway REST API endpoints.