CVE-2026-76398

Received Received - Intake

Splunk AI Toolkit Unauthorized Experiment History Deletion

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk AI Toolkit deletes experiment history before it verifies that the user can delete the associated experiment. For more information see Experiment Assistants (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.6.4/experiment-assistants) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76398

EUVD

EUVD-2026-62963

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_ai_toolkit	to 6.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Splunk AI Toolkit versions below 6.0.1. A user without admin or power roles can delete another user's experiment history via the REST API. The issue occurs because the toolkit deletes history before verifying user permissions for the associated experiment.

Detection Guidance

To detect this vulnerability, check Splunk AI Toolkit logs for unauthorized experiment history deletions via the REST API. Look for API calls to endpoints related to experiment history without admin or power role permissions. Review user access logs for non-admin users performing deletion actions.

Impact Analysis

An attacker could delete another user's experiment history without permission, potentially causing data loss or disrupting workflows. This could lead to unauthorized changes in machine learning experiments or loss of important research data.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized deletion of sensitive data, which may violate data integrity and retention requirements in GDPR and HIPAA. Unauthorized modifications to experiment history could also affect audit trails.

Mitigation Strategies

Upgrade Splunk AI Toolkit to version 6.0.1 or later to address the vulnerability. Ensure only admin or power role users can delete experiment history. Review and restrict API access permissions to prevent unauthorized deletions.

Hi! I’m here to help you understand CVE-2026-76398. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70