Authenticated code execution via insecure jsonpickle deserialization

Unsafe deserialization in Splunk Enterprise and Splunk Secure Gateway allows remote authenticated users to execute arbitrary code. The Secure Gateway app passes attacker-controlled data to the jsonpickle Python library using an insecure deserialization pattern that can instantiate code-bearing objects. A low-privileged account without the admin or power role is sufficient, and successful exploitation executes code in the affected Splunk service context.