CVE-2026-76392

Received Received - Intake

Hard-Coded Credentials in Splunk AI Toolkit

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for connected container services using predictable or hard-coded default values. For more information see Connections tab in the AI Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.7.2/ai-toolkit-commands-macros-and-visualizations/connections-tab-in-the-ai-toolkit) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76392

EUVD

EUVD-2026-62957

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_ai_toolkit	to 6.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

In Splunk AI Toolkit versions below 6.0.0, non-admin or non-power users can obtain predictable or default credentials for connected container services due to hard-coded or predictable credential generation and storage.

Detection Guidance

Check Splunk AI Toolkit versions below 6.0.0 for hard-coded or predictable credentials in connected container services. Review the Connections tab in the AI Toolkit for default credential usage. Inspect Splunk logs for unauthorized access attempts or unusual container service connections.

Impact Analysis

An attacker with access but not admin privileges could exploit this to gain unauthorized access to container services, potentially leading to data breaches, service disruption, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA, potentially resulting in legal penalties and loss of compliance certifications.

Mitigation Strategies

Upgrade Splunk AI Toolkit to version 6.0.0 or later to address the hard-coded credential issue. Remove or rotate any default or predictable credentials used by connected container services. Restrict access to the AI Toolkit Connections tab to admin or power Splunk roles only.

Hi! I’m here to help you understand CVE-2026-76392. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70