This vulnerability allows a non‑admin Splunk user to derive the PostgreSQL sidecar database superuser password from the search head cluster identifier exposed in search job logs, and then run arbitrary operating system commands as the Splunk Enterprise service account. The effect is the compromise of confidentiality, integrity, and availability of the host operating system where the Splunk service runs, including the ability to modify data, exfiltrate information, or disrupt services. The weakness corresponds to CWE‑321 and results in remote code execution in the context of the Splunk service.

Splunk Enterprise on versions older than 10.4.4, 10.2.8, 10.0.11, and 9.4.16 is impacted. Any deployment using the PostgreSQL sidecar service in a search head cluster can be affected, particularly those that do not limit role access to admin or power roles for database password derivation.

The CVSS score is 8.8, indicating a high severity. EPSS is not available, and it is not listed in the CISA KEV catalog, so the current exploitation probability is unknown but the high score suggests significant risk. Attackers can leverage existing Splunk user accounts to exploit the flaw, so any user with a Splunk role other than admin or power can potentially gain root-level privileges on the host. The likely attack vector is local to the Splunk platform, requiring authentication to the Splunk web console or API; no network exposure is indicated, so the vulnerability is primarily an internal privilege escalation within Splunk.