EUVD-2026-62956
GHSA-g2mq-q5g6-g67q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Network-accessible Splunk UI requires only PR:L (any authenticated account); C:H and I:H reflect full data access and cross-user job manipulation; A:L for limited search job deletion impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improper privilege management is possible because the Agent Run History handler replaces the calling user session key with a system authentication token before it performs search operations. For more information see AI Toolkit Agent Launchpad (https://help.splunk.com/en/splunk-enterprise/apply-machine-learning/use-ai-toolkit/6.0.0/ai-toolkit-connections-containers-and-agents/ai-toolkit-agent-launchpad) in the Splunk documentation.
AnalysisAI
Privilege escalation in Splunk AI Toolkit before 6.0.0 allows any authenticated low-privileged user to operate with system-level permissions by exploiting a session key substitution flaw in the Agent Run History handler. The handler unconditionally replaces the caller's session key with a system authentication token before executing searches, completely bypassing Splunk's role-based access controls that gate elevated operations behind 'admin' or 'power' roles. This grants unauthorized read access to all indexed data, cross-user search job enumeration and deletion, and write-level system integrity impact - no public exploit has been identified at time of analysis, but the low exploitation complexity and clear mechanism description make this a high-priority patching target for Splunk enterprise deployments.
Technical ContextAI
The vulnerability affects the Agent Run History handler within Splunk AI Toolkit (CPE: cpe:2.3:a:splunk:splunk_ai_toolkit:*:*:*:*:*:*:*:*), a Splunk app providing AI-driven agent workflows through the AI Toolkit Agent Launchpad interface. CWE-863 (Incorrect Authorization) identifies the root cause: rather than enforcing role checks on the calling user, the handler performs a session key swap - substituting the authenticated user's scoped session key with a privileged system authentication token - before dispatching search operations to the Splunk search tier. This design flaw means Splunk's role-based access control model, which gates elevated search capabilities behind 'admin' and 'power' roles, is entirely circumvented at the handler layer. The flaw is architectural: the privilege elevation is intentional design for system operations but lacks a prior authorization gate to verify the caller holds the required role.
RemediationAI
Upgrade Splunk AI Toolkit to version 6.0.0 or later, which resolves the session key substitution flaw per Splunk advisory SVD-2026-0808 (https://advisory.splunk.com/advisories/SVD-2026-0808). If an immediate upgrade is not operationally feasible, restrict access to the AI Toolkit app via Splunk's role-based app access controls so that only users holding 'admin' or 'power' roles can access the AI Toolkit Agent Launchpad - this prevents exploitation by lower-privileged accounts but disables AI Toolkit functionality for those users entirely, which may affect workflows that depend on broader user access to the app. Additionally, audit Agent Run History activity logs for anomalous search execution patterns from non-admin or non-power accounts to identify any prior exploitation. Do not rely on network-layer controls alone, as the flaw requires only authenticated Splunk session access, which is typically permitted broadly within enterprise deployments.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today