In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user without admin or power roles can register an arbitrary companion app. This allows Splunk Secure Gateway to forward mobile user requests, including tokens that could compromise data, to an attacker-controlled URL. The vulnerability stems from a hard-coded cryptographic key in the companion app registration handler that permits arbitrary callback URL registration without restriction.

An attacker with non-admin privileges can exploit this vulnerability to redirect mobile user requests and tokens to attacker-controlled URLs, potentially compromising all relevant data accessible to the affected mobile user. The confidentiality of user data is impacted, but integrity and availability are not affected.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for suspicious companion app registrations.