This vulnerability permits a user who has access to the _internal index in a Splunk Search Head Cluster to read the conf.log file. The log file reveals plain text SAML configuration details for Attribute Query Requests or Authentication extensions, which is a form of sensitive data exposure matching CWE-532. The exposed information could aid an adversary in mapping authentication flows or identifying potential weak spots in the SAML setup, though it does not directly grant system privileges or credentials.

Affected systems include Splunk Enterprise versions lower than 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, as well as Splunk Cloud Platform versions lower than 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120. The issue arises in deployments that use a Search Head Cluster where a role grants index access to the _internal data source.

The CVSS score of 6.8 indicates moderate severity, while the EPSS score of <1% reflects a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user with sufficient role privileges on a Search Head Cluster; once that access is present, the attacker can read SAML configuration data from logs without network interaction, making the attack local to authorized users only.