In affected Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user lacking 'admin' or 'power' roles can exploit a flaw in the Splunk App for Splunk Observability Cloud. The app's REST API endpoint handlers fail to enforce the read_o11y_content capability, allowing unauthorized forwarding of requests with the stored Splunk Observability Cloud access token. This token exposure permits viewing of all data accessible by the token and limited modification of Splunk Observability Cloud content. The vulnerability does not impact versions 9.3 and 9.4. The CVSS 3.1 score is 7.1 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact with limited integrity impact.

An unauthorized user without elevated Splunk roles can access sensitive data available to the Splunk Observability Cloud access token and perform limited changes to cloud content. This compromises confidentiality of data accessible via the token and integrity of some cloud content. There is no impact on availability. The vulnerability affects multiple versions below 10.4.2, 10.2.6, and 10.0.9, but not versions 9.3 or 9.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to prevent unprivileged users from accessing the Splunk App for Splunk Observability Cloud or forwarding requests with stored access tokens. Review and enforce role capabilities, especially the read_o11y_content capability, to limit unauthorized access. Monitor Splunk documentation for updates on patches or official fixes.