In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST) API request that deletes or temporarily overwrites files writable by the user account running Splunk Enterprise processes on a non-captain search head cluster member. The vulnerability is possible because Search Head Clustering bundle replication does not validate the name of a replicated bundle file or neutralize NUL bytes before constructing the member bundle path. For more information see About search head clustering (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-search-head-clustering/about-search-head-clustering), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and Secure Splunk Enterprise service accounts (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.0/install-splunk-enterprise-securely/secure-splunk-enterprise-service-accounts) in the Splunk documentation.

• https://advisory.splunk.com/advisories/SVD-2026-0801

• Splunk » Splunk » Version: 10.0.0
  cpe:2.3:a:splunk:splunk:10.0.0
• Splunk » Splunk » Version: 10.0.1
  cpe:2.3:a:splunk:splunk:10.0.1
• Splunk » Splunk » Version: 10.0.2
  cpe:2.3:a:splunk:splunk:10.0.2
• Splunk » Splunk » Version: 10.0.3
  cpe:2.3:a:splunk:splunk:10.0.3
• Splunk » Splunk » Version: 10.0.4
  cpe:2.3:a:splunk:splunk:10.0.4
• Splunk » Splunk » Version: 10.0.5
  cpe:2.3:a:splunk:splunk:10.0.5
• Splunk » Splunk » Version: 10.0.7
  cpe:2.3:a:splunk:splunk:10.0.7
• Splunk » Splunk » Version: 10.0.8
  cpe:2.3:a:splunk:splunk:10.0.8
• Splunk » Splunk » Version: 10.2.0
  cpe:2.3:a:splunk:splunk:10.2.0
• Splunk » Splunk » Version: 10.2.1
  cpe:2.3:a:splunk:splunk:10.2.1
• Splunk » Splunk » Version: 10.2.2
  cpe:2.3:a:splunk:splunk:10.2.2
• Splunk » Splunk » Version: 10.2.4
  cpe:2.3:a:splunk:splunk:10.2.4
• Splunk » Splunk » Version: 10.2.5
  cpe:2.3:a:splunk:splunk:10.2.5
• Splunk » Splunk » Version: 10.4.0
  cpe:2.3:a:splunk:splunk:10.4.0
• Splunk » Splunk » Version: 10.4.1
  cpe:2.3:a:splunk:splunk:10.4.1
• Splunk » Splunk » Version: 9.4.0
  cpe:2.3:a:splunk:splunk:9.4.0
• Splunk » Splunk » Version: 9.4.1
  cpe:2.3:a:splunk:splunk:9.4.1
• Splunk » Splunk » Version: 9.4.10
  cpe:2.3:a:splunk:splunk:9.4.10
• Splunk » Splunk » Version: 9.4.11
  cpe:2.3:a:splunk:splunk:9.4.11
• Splunk » Splunk » Version: 9.4.12
  cpe:2.3:a:splunk:splunk:9.4.12
• Splunk » Splunk » Version: 9.4.13
  cpe:2.3:a:splunk:splunk:9.4.13
• Splunk » Splunk » Version: 9.4.2
  cpe:2.3:a:splunk:splunk:9.4.2
• Splunk » Splunk » Version: 9.4.3
  cpe:2.3:a:splunk:splunk:9.4.3
• Splunk » Splunk » Version: 9.4.4
  cpe:2.3:a:splunk:splunk:9.4.4
• Splunk » Splunk » Version: 9.4.5
  cpe:2.3:a:splunk:splunk:9.4.5
• Splunk » Splunk » Version: 9.4.6
  cpe:2.3:a:splunk:splunk:9.4.6
• Splunk » Splunk » Version: 9.4.7
  cpe:2.3:a:splunk:splunk:9.4.7
• Splunk » Splunk » Version: 9.4.8
  cpe:2.3:a:splunk:splunk:9.4.8
• Splunk » Splunk » Version: 9.4.9
  cpe:2.3:a:splunk:splunk:9.4.9