Splunk AI Toolkit
CVE-2026-20265
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-exploitable by any authenticated low-privileged user; no scope change as impact is confined to Splunk data confidentiality with no integrity or availability effect.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
1DescriptionCVE.org
In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exfiltration.
The vulnerability exists because of an insecure default domain allowlist in the Splunk AI Toolkit, which does not restrict outbound AI agent requests to approved external domains.
AnalysisAI
Outbound SSRF-class data exfiltration in Splunk AI Toolkit versions below 5.7.4 allows any low-privileged authenticated Splunk user - without admin or power roles - to redirect the AI agent's HTTP request mechanism to an attacker-controlled server. The root cause is an insecure default domain allowlist shipped with the toolkit that places no restrictions on which external domains the AI agent may contact. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low privilege barrier makes it broadly relevant in enterprise Splunk deployments with many standard users.
Technical ContextAI
The Splunk AI Toolkit is an add-on that extends Splunk with AI agent capabilities, including the ability to make outbound HTTP requests to external services. CWE-1188 (Insecure Default Initialization of Resource) identifies the root cause: the toolkit ships with a permissive default domain allowlist that fails to constrain which external HTTP endpoints the AI agent may contact. This is functionally a Server-Side Request Forgery (SSRF) variant mediated through the AI agent request pipeline - the allowlist is the sole enforcement boundary, and in its default misconfigured state, any user who can invoke AI agent functionality can direct outbound requests arbitrarily. The affected product is identified by CPE cpe:2.3:a:splunk:splunk_ai_toolkit:*:*:*:*:*:*:*:*, covering all versions prior to 5.7.4.
RemediationAI
Upgrade the Splunk AI Toolkit to version 5.7.4 or later, which resolves this vulnerability by implementing a restrictive default domain allowlist that limits outbound AI agent requests to approved external domains. Consult vendor advisory SVD-2026-0613 at https://advisory.splunk.com/advisories/SVD-2026-0613 for complete remediation guidance and any platform-specific instructions. As a compensating control prior to patching, administrators should manually configure the AI Toolkit's domain allowlist to restrict outbound requests to explicitly approved, known-good domains - this directly addresses the root cause without requiring an upgrade, though the trade-off is operational overhead and the risk of allowlist drift. Additionally, restricting access to AI Toolkit functionality to only users with admin or power roles via Splunk's RBAC controls would eliminate the low-privilege exploitation path, at the cost of reducing availability of the feature to standard users.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today