A vulnerability in Splunk Enterprise allows a user with the 'power' role to embed risky Search Processing Language (SPL) commands into a Table Editor dataset and share it. When an 'admin' role user opens the dataset, the stored commands run with the admin’s permissions, enabling the attacker to read all data available to the admin and alter lookup files. The flaw arises because the Table Editor applies SPL safeguards only to the user’s view of the dataset, not to the initial data-population query that triggers the risky commands. This results in an unintended privilege escalation that can compromise data confidentiality and integrity without executing arbitrary code. The impact is limited to scenarios where the vulnerable Splunk Web interface is enabled and where the attacker can manipulate a privileged administrator into opening a crafted dataset.

All Splunk Enterprise installations running a version older than 10.4.2, 10.2.6, 10.0.9, or 9.4.14 are vulnerable. The flaw requires the Splunk Web component to be active; therefore only instances that expose Splunk Web are at risk. The Table Editor, which is part of the web interface, is the attack vector. Users with the predefined 'power' role are the source of the risky commands, while users with the 'admin' role can unintentionally trigger them. To remediate, upgrade to a fixed release, disable Splunk Web if the interface is not needed, or restrict the use of the Table Editor by revoking the 'power' role from untrusted users.

The CVSS score of 5.4 reflects moderate severity. Because the EPSS score is not available, the likelihood of exploitation in the wild is unclear, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires social engineering: an attacker must first create a risky dataset as a power‑role user and then trick an admin into opening the dataset in their browser. This requirement reduces the attack surface compared to more direct remote code execution vulnerabilities, but the potential impact remains significant given the elevated privileges exercised upon trigger.