Privilege escalation in Splunk Ai Toolkit
CVE-2026-76396
In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedule_search capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply search command as risky. For more information see Troubleshoot the AI Toolkit (https://help.splunk.com/en/splunk-enterprise/apply-machine-learning/use-ai-toolkit/5.7.3/troubleshooting-the-ai-toolkit/troubleshoot-the-ai-toolkit) in the Splunk documentation.
Vulnerability class: Privilege Escalation
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-76396?
- CVE-2026-76396 is a high-severity vulnerability in Splunk Ai Toolkit, classified under Improper Privilege Management. CVSS score: 7.5/10. Published 2026-08-19.
- How severe is CVE-2026-76396?
- High severity. CVSS v3 base score is 7.5 out of 10.