CVE-2026-76394

In Splunk AI Toolkit versions below 5.7.4, a user with the 'admin' role can execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is due to an unsafe shell execution pattern in the btool configuration helper.

In Splunk AI Toolkit versions below 6.0.1, a user with the "power" role could modify app-provided scheduled searches to run arbitrary SPL using the permissions of the search owner. This could allow access to all relevant data and affect system integrity.

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the REST API. The vulnerability is possible because Splunk AI Toolkit deletes experiment history before it verifies that the user can delete the associated experiment.

In Splunk AI Toolkit versions below 6.0.0, a user with the "power" role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is due to not preserving the trusted experiment scope when processing caller-controlled query values.

In Splunk AI Toolkit versions below 6.0.0, a user with a role having the schedule_search capability could cause a scheduled search to load and deserialize a model file through the apply search command. The vulnerability is due to the apply search command not being marked as risky.

In Splunk AI Toolkit versions below 6.0.0, a user with the "power" role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The vulnerability is due to deserialization of untrusted data without guarding against embedded pickle content.

In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The race condition is possible because Splunk AI Toolkit does not verify that the uploaded content belongs to the request that creates the model lookup entry.

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for connected container services using predictable or hard-coded default values.

In Splunk AI Toolkit versions below 6.0.0, a user without "admin" or "power" roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The vulnerability is due to replacing the calling user session key with a system authentication token before performing search operations.

In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the 'admin' or 'power' roles could cause the toolkit to make outbound HTTP requests to a server controlled by an attacker, potentially leading to data exfiltration.