Loading story…
Splunk removed a hunting analytic after the underlying vulnerabilities were patched in current releases, but the detection documented how low-privilege users could attempt to access hashed Splunk passwords through the conf-user-seed REST endpoint. The analytic monitored splunkd_web access logs for requests to that endpoint because such activity could expose credential material and support privilege escalation to full administrative control of a Splunk instance.
The activity was mapped to MITRE ATT&CK technique T1212 (Exploitation for Credential Access), which covers abuse of software flaws to obtain credentials or bypass authentication controls. MITRE notes that this class of exploitation can enable forged authentication artifacts, replayed authentication traffic, unintended token creation or renewal in cloud environments, and broader privilege escalation when credentialing systems are affected.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the detection "Splunk Low Privilege User Can View Hashed Splunk Password" from its content library, stating that the associated CVEs had been patched in the latest Splunk release. The removal was noted in content library version 5.6.0.
MITRE ATT&CK published technique T1212, "Exploitation for Credential Access," describing how adversaries exploit software vulnerabilities to obtain credentials or bypass authentication, including examples such as MS14-068 and replay attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk documented and later removed a detection for privilege escalation in which low-privilege users could abuse the `edit_user` capability to obtain administrative access. The analytic monitored `_audit` logs for password-related actions including `change_own_password`, `password_change`, and `edit_password` when access was granted to accounts that were not administrators or system users, and warned that successful exploitation could result in full control of the Splunk environment and potential data exposure. The detection was mapped to MITRE ATT&CK technique **T1548: Abuse Elevation Control Mechanism**, which covers privilege escalation and defense evasion through misuse of built-in control mechanisms across platforms. Splunk marked the analytic as deprecated and removed it after the underlying issue, tracked as **`CVE-2023-32707`**, was patched in current releases, noting the detection had been disabled by default, required access to the `_audit` index, and could produce false positives during legitimate password changes.
Aug 12, 2026
Splunk documented and later retired a detection for unauthorized `POST` requests to the `/services/indexing/preview` REST endpoint after the underlying RBAC-bypass vulnerabilities were patched in current releases. The analytic watched Splunk's `_internal` index for attempts to abuse the endpoint, which could allow a user without proper authorization to interact with indexing preview functions tied to an existing search job. Successful exploitation could let an attacker who knew a valid search ID overwrite search results, manipulate visible data, and gain unauthorized access to sensitive information, undermining the integrity of Splunk investigations and reporting. Separately, MITRE ATT&CK catalogs **Access Token Manipulation** as Windows privilege-escalation technique `T1134`, including abuse of privileges such as `SeDebugPrivilege` and `SeImpersonatePrivilege`, but the Splunk issue itself centers on application-layer authorization bypass rather than host-level token theft.
Aug 12, 2026
Splunk disclosed and patched **CVE-2024-45734**, an image file disclosure vulnerability in Splunk Enterprise that allowed low-privileged users without `admin` or `power` roles to view images stored on the host machine through the **PDF export** feature in classic dashboards. The issue affected versions **9.3.0**, **9.2.3**, and **9.1.6**, creating a path for unauthorized access to locally referenced image content embedded in dashboards using version `1.1` and `<img>` tags. Splunk Threat Research had published a detection to help defenders identify possible exploitation by hunting for generated PDFs tied to classic dashboards and looking for indicators such as localhost image paths, but that content was later removed after the flaw was patched in current releases. The exposure aligns with attacker tradecraft described in **MITRE ATT&CK `T1087` Account Discovery**, where adversaries abuse accessible interfaces, built-in tools, or misconfigurations to gather information that can support follow-on compromise and privilege abuse.
Aug 12, 2026