Splunk Monitoring Console App Accessible to Low-Privileged Users

Summary

A user with limited access to a Splunk Enterprise system can access sensitive information by exploiting a permission error in the Monitoring Console App. This could let them see confidential data. To fix this, update to version 10.0.2, 10.0.3, 9.4.8, or 9.3.9 or later, or restrict access to the Monitoring Console App for non-admin users.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
splunk	splunk	> 9.3.0 , <= 9.3.9	–
splunk	splunk	> 9.4.0 , <= 9.4.8	–
splunk	splunk	> 10.0.0 , <= 10.0.3	–

Original title

In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin" Splunk role could access the Splunk Monitoring Console App endpoints due to...

Original description

In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin" Splunk role could access the Splunk Monitoring Console App endpoints due to an improper access control. This could lead to a sensitive information disclosure.<br><br>The Monitoring Console app is a bundled app that comes with Splunk Enterprise. It is not available for download on SplunkBase, and is not installed on Splunk Cloud Platform instances. This vulnerability does not affect [Cloud Monitoring Console](https://help.splunk.com/en/splunk-cloud-platform/administer/admin-manual/10.2.2510/monitor-your-splunk-cloud-platform-deployment/introduction-to-the-cloud-monitoring-console).

nvd CVSS3.1 6.5

Vulnerability type

CWE-200 Information Exposure

https://advisory.splunk.com/advisories/SVD-2026-0206 Vendor Advisory