This vulnerability allows a user without elevated Splunk roles to read sensitive search log data through the MongoClient logging channel. The improper access control exposes confidential information that should only be available to administrators, compromising confidentiality for affected accounts.

Splunk Enterprise installations prior to versions 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform releases earlier than 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9.3.2411.124 are vulnerable. These include both the enterprise appliance and the cloud‑based service.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score of less than 1 percent suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access as a low‑privileged user; no remote unauthenticated vector is described, so exploitation is limited to users who can log into the Splunk instance.