CVE-2026-76399

Received Received - Intake

Privilege Escalation in Splunk AI Toolkit via SPL Modification

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. The vulnerability is possible because Splunk AI Toolkit gives the "power" Splunk role permission to modify scheduled searches that run using the permissions of the search owner.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76399

EUVD

EUVD-2026-62964

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_ai_toolkit	to 6.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

In Splunk AI Toolkit versions below 6.0.1, a user with the 'power' Splunk role can modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner. This allows access to all relevant data and could affect system integrity.

Detection Guidance

To detect this vulnerability, check Splunk AI Toolkit versions below 6.0.1. Verify if users with the 'power' role can modify scheduled searches. Review SPL commands in scheduled searches for unauthorized modifications.

Impact Analysis

An attacker with the 'power' role could gain unauthorized access to sensitive data, execute malicious searches, or alter system configurations, leading to data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Update Splunk AI Toolkit to version 6.0.1 or later to address the vulnerability. Remove the 'power' role's permission to modify scheduled searches if not required. Review and restrict user roles with elevated privileges to prevent unauthorized SPL execution.

Hi! I’m here to help you understand CVE-2026-76399. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70