In Splunk Enterprise versions prior to 10.2.0, 10.0.2, 9.4.7, 9.3.9 and 9.2.11, a user with a role that allows access to the internal index can read the RSA accessKey value from the Authentication.conf file in plain text. The flaw is a classic information‑disclosure weakness.

Splunk Enterprise deployments that use a Search Head Cluster and run versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9 or 9.2.11 are impacted. The vulnerability involves the internal index stored in the cluster and the Authentication.conf configuration file.

The CVSS base score is 6.8, indicating a moderate severity. The EPSS score is below 1 percent, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to possess a role with read access to the internal index; this is typically a privileged role within the organization.