EUVD-2026-62958
GHSA-qh4m-xcwc-wcgw
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
Network-accessible race condition requires authenticated low-privilege upload rights and a concurrent victim upload; integrity is high as attacker fully controls substituted model content.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The race condition is possible because Splunk AI Toolkit does not verify that the uploaded content belongs to the request that creates the model lookup entry. For more information see Troubleshoot the Splunk Machine Learning Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/machine-learning-toolkit-user-guide/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) in the Splunk documentation.
AnalysisAI
Unauthenticated model content injection in Splunk AI Toolkit below 6.0.0 allows an authenticated attacker with model upload privileges to overwrite another user's in-progress model upload by racing concurrent requests to the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The root cause is the toolkit's failure to bind uploaded file content to the specific request that creates the corresponding model lookup entry, enabling a TOCTOU-style substitution. No public exploit code or CISA KEV listing has been identified; the vendor (Splunk) has released a patch in version 6.0.0.
Technical ContextAI
Splunk AI Toolkit (historically branded as the Machine Learning Toolkit / MLTK) extends the Splunk platform with model upload and management capabilities, allowing users to import trained ML models for use in Splunk search pipelines via lookup entries. The race condition (CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) arises during the multi-step model upload process: the toolkit fails to atomically associate uploaded file content with the lookup entry creation step, leaving a window in which a concurrent request targeting the same model name can substitute different content. This is a classic TOCTOU (Time-of-Check Time-of-Use) weakness. Affected product is identified by CPE cpe:2.3:a:splunk:splunk_ai_toolkit:*:*:*:*:*:*:*:*, covering versions 5.7 through below 6.0.0 per EUVD-2026-62958. The vulnerability was reported by Cisco.
RemediationAI
Upgrade Splunk AI Toolkit to version 6.0.0 or later, which addresses the race condition by properly binding uploaded content to the originating request before creating the model lookup entry. The vendor advisory is available at https://advisory.splunk.com/advisories/SVD-2026-0808. If immediate upgrade is not possible, restrict model upload permissions to the minimum set of trusted users via Splunk role-based access controls - this reduces the attacker pool to privileged insiders and limits the blast radius. Additionally, auditing model lookup entries for unexpected changes (via Splunk's audit log or lookup file integrity monitoring) can serve as a compensating detective control. No network-level workaround can mitigate this flaw, as the race is internal to the application logic.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today