Splunk AI Toolkit
CVE-2026-20266
CRITICAL
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable Splunk management plane (AV:N), no special conditions beyond admin role (AC:L, PR:H), no user interaction, and shell escape from splunkd to OS justifies S:C with full CIA impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance.
The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.
AnalysisAI
Authenticated command injection in Splunk AI Toolkit versions below 5.7.4 allows a user with the Splunk admin role to execute arbitrary OS commands on the underlying Splunk Enterprise host. The flaw lives in the btool configuration helper, which builds shell command strings from dynamic parameters with shell interpretation enabled. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
The Splunk AI Toolkit is an add-on app for Splunk Enterprise that integrates machine learning and large-language-model workflows. CPE cpe:2.3:a:splunk:splunk_ai_toolkit:*:*:*:*:*:*:*:* identifies the affected app distribution. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), specifically an unsafe shell=True style invocation around Splunk's btool configuration helper. Because dynamic parameters are concatenated into a command string that is then passed through a shell interpreter, metacharacters such as ;, |, $(), and backticks are evaluated rather than treated as literal arguments, allowing arbitrary commands to run with the privileges of the splunkd process.
RemediationAI
Vendor-released patch: upgrade the Splunk AI Toolkit app to version 5.7.4 or later, per Splunk advisory SVD-2026-0614 (https://advisory.splunk.com/advisories/SVD-2026-0614). Until the upgrade is applied, restrict the Splunk admin role to a minimal set of trusted operators, audit role assignments and capability inheritance, and remove or disable the Splunk AI Toolkit app on instances that do not actively use it (uninstalling the app removes the vulnerable btool helper at the cost of losing ML/LLM workflows). Monitor splunkd and OS process logs for unexpected shell child processes spawned by the splunkd user as a detection compensating control.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today