The vulnerability stems from missing authorization checks on Search Head Cluster member control endpoints. A user with the list_search_head_clustering capability can issue a read request that the system treats as read‑only but actually performs a state‑changing operation. This enables the attacker to modify cluster configuration and bring the cluster into an inconsistent or unusable state, resulting in a denial of service. The flaw is identified as CWE‑862, missing authorization.

All deployments of Splunk Enterprise running a version earlier than 10.4.2, 10.2.6, 10.0.9, or 9.4.14 are susceptible. Any role that contains the list_search_head_clustering capability, regardless of other permissions, can trigger this problem when the user is authenticated to the web interface.

The CVSS score of 3.8 indicates a low overall severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation activity. Exploitation requires an authenticated session on the Splunk web tier and possession of the list_search_head_clustering capability; therefore the attack vector is inferred to be the web interface, based on the description’s reference to read requests. The required privilege level suggests that the threat would likely arise from an insider or a compromised user account.