A privilege misuse flaw in Splunk Enterprise allows a user of a Search Head Cluster who has a role that can access the internal index to read sensitive Duo Two-Factor Authentication secrets such as integrationKey, secretKey, and appSecretKey in plain text. This results in exposure of credentials that could be used to compromise the associated services or to impersonate authenticated users. The weakness is classified as CWE-532, indicating insecure logging of sensitive information.

Splunk Enterprise software versions lower than 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11 are susceptible. The vulnerability is limited to deployments that include a Search Head Cluster and roles that grant read access to the internal index.

The CVSS base score is 6.8, indicating a medium to potentially high impact. EPSS is listed as < 1%, suggesting that active exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. Likely attack conditions require a user with appropriate internal index permissions, meaning the attack vector is role-based access within the SHC. With these privileges, an attacker can enumerate the exposed secrets, enabling potential lateral movement or service disruption.