Splunk Enterprise Edge Processor sidecar: Prometheus metrics endpoint served without authentication

Impact

The Prometheus metrics endpoint on the Edge Processor SPL2 Preview sidecar accepts requests with no credentials, so any client that can route to the sidecar can pull its service metrics along with runtime and build metadata. The advisory describes disclosure only — no write path, no code execution, no log content. The practical value to an attacker is reconnaissance: exact build and runtime details of a logging component that typically sits close to the fleet's telemetry path. It matters most where the sidecar's port is reachable from tenant or workload networks rather than a dedicated management segment.

Who can reach it

Anyone with network reach to the sidecar's metrics port. No authentication and no Splunk account required. Limited to Splunk Enterprise 10.4 below 10.4.2; releases before 10.4 do not have the component.

What to do

Upgrade to Splunk Enterprise 10.4.2 per SVD-2026-0801, which restarts the Splunk service and the sidecar — no node reboot. Until then, restrict network access to the sidecar's metrics port to the monitoring collectors that need it.

References