CVE-2023-46231 is a flaw in Splunk Add-on Builder versions below 4.1.4 that writes user session tokens to its internal log files. NVD scores it 6.8 medium, while Splunk's advisory scores it 8.8 high. Upgrade to 4.1.4 or later, then clean up logs and restart Splunk.
What's affected
Splunk Add-on Builder versions below 4.1.4 are affected, and 4.1.4 is the fixed version. The advisory says add-ons generated by Add-on Builder are not affected.
The sources disagree on severity. The NVD record shows CVSS 6.8 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. The Splunk advisory SVD-2024-0110 shows 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. The vector strings are the same in what we read, so the numbers do not match their own vectors. Plan around the higher figure, but note the difference.
The NVD record scores it 6.8 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. The weakness class is CWE-532 (sensitive information in a log file). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Open the Splunk web interface, go to Apps, Manage Apps, and read the version of Splunk Add-on Builder. Anything below 4.1.4 is affected. You can also look in the app directory under your Splunk apps folder for the app manifest.
Then look at where the logs are. The advisory says tokens are written when someone visits the Add-on Builder or builds or edits a custom app or add-on.
What to do now
- Upgrade Splunk Add-on Builder to 4.1.4 or later.
- Restrict access to internal indexes to administrator roles, as the advisory advises.
- Delete the Add-on Builder log files in the Splunk log directory and remove logged events from the splunk:tabuilder:log sourcetype. This needs the can_delete role.
- Restart Splunk Enterprise, which Splunk says invalidates all existing session tokens.
- Record the version in your inventory.
Why it matters
Writing credentials or session tokens into logs is a quiet mistake. Logs are copied, indexed and shared widely, and the people who can read them are often not the people who should hold sessions. The weakness is CWE-532.
Splunk's advisory says exploitation needs local access to the logs or access to internal indexes, which narrows the exposure. Still, a valid token for an administrator is worth treating as a credential leak.
Quick check
Why do the scores differ?
NVD shows 6.8 and Splunk shows 8.8. We report both. Use the higher number for planning.
Does a restart matter?
Yes. Splunk says restarting Splunk Enterprise invalidates existing session tokens.
Sources
Last reviewed: 19 October 2026.
