CVE-2026-20238
Stored XSS in Splunk AI Toolkit
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| splunk | splunk_ai_toolkit | to 5.7.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-20238 is an improper access control vulnerability in the Splunk AI Toolkit app versions below 5.7.3.
A low-privileged user who does not have 'admin' or 'power' roles can access confidential data that should be restricted by srchFilter configurations on custom roles.
This happens because the app's authorize.conf file modifies the built-in 'user' role, and the Splunk platform combines inherited search filters using the OR SPL operator, which overrides more restrictive filters on child roles.
How can this vulnerability impact me? :
This vulnerability allows low-privileged users to access confidential data that should be restricted, potentially exposing sensitive information.
Since the vulnerability leads to unauthorized data disclosure, it can compromise data confidentiality without affecting data integrity or availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in Splunk AI Toolkit versions below 5.7.3, you should take the following immediate steps:
- Upgrade the Splunk AI Toolkit app to version 5.7.3 or higher.
- Disable the Splunk AI Toolkit app until the patch is applied.
- Edit the authorize.conf file to remove or override the srchFilter line that modifies the built-in 'user' role.
- Restrict access to the ai_agent_run_history_index index.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows low-privileged users to access confidential data that should be restricted, which can lead to unauthorized disclosure of sensitive information.
Such unauthorized access to confidential data may result in non-compliance with data protection regulations and standards like GDPR and HIPAA, which require strict controls over access to sensitive personal and health information.
Therefore, organizations using affected versions of the Splunk AI Toolkit could face compliance risks if this vulnerability is exploited.