In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user lacking admin or power roles can exploit improper validation of decoded report notification identifiers. By crafting report notification data, the user can cause Splunk Secure Gateway to send requests to the Splunk Enterprise REST API using a system-level session token. This allows modification of platform configuration and acquisition of a session token without a password, compromising confidentiality, integrity, and availability of the system. The vulnerability is identified as CWE-918 (Server-Side Request Forgery).

An attacker with limited privileges can escalate access to system-level privileges without authentication, enabling unauthorized access to sensitive data and modification of system configurations. This results in high impact on confidentiality, integrity, and availability of the affected Splunk platforms.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Splunk Secure Gateway and monitor for suspicious activity related to report notifications. Avoid granting unnecessary roles that could exploit this vulnerability.