A flaw in the Splunk App for Splunk O11y Cloud allows a user with read_o11y_content capability to insert forged entries into the application log via the REST API. This is an instance of log injection (CWE-117), where user‑supplied data is written to log output without proper sanitization. The main consequence is that attackers can alter log contents, potentially hiding malicious activity or fabricating malicious events, which undermines incident response and forensic accuracy.

Splunk Enterprise versions earlier than 10.4.3, 10.2.7, and 10.0.10 are affected. The 9.4.x series is not impacted. Any deployment that uses the Splunk App for Splunk O11y Cloud and assigns users the read_o11y_content role can be targeted.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a user possessing the read_o11y_content role gaining access to the REST API of the app; the attacker can craft requests that inject arbitrary log entries. Given the absence of a publicly known exploit and the requirement for specific role permissions, the risk of widespread exploitation remains low, but the potential impact on log integrity warrants attention.