The vulnerability lies in the Prometheus metrics endpoint of the Edge Processor SPL2 Preview sidecar running in Splunk Enterprise. Because the endpoint does not enforce authentication, any client that can reach the sidecar can read service metrics that expose runtime and build metadata. This information could reveal internal network structure, configuration details, and other sensitive data, potentially assisting an adversary in further attacks. The flaw is a classic data disclosure weakness, classified as CWE-200.

Splunk Enterprise is affected. Versions 10.4.0 through 10.4.1, 10.2.0 through 10.2.5, 10.0.0 through 10.0.8, and 9.4.0 through 9.4.13 are vulnerable because the Prometheus metrics endpoint lacks authentication. All other major releases prior to the specified patch versions are considered safe after applying the update.

The CVSS score for this vulnerability is 7.5, indicating a high impact on confidentiality. The EPSS score is not available, so the current exploitation probability cannot be precisely quantified, but the lack of authentication means the attack vector is essentially any host that can reach the sidecar, which could be an internal or compromised machine. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploit at this time. Nevertheless, the potential for sensitive data exposure justifies prompt remediation.