EUVD-2026-62964
GHSA-x8wf-gj49-q42j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Splunk is network-accessible; 'power' role is a low-privilege authenticated requirement (PR:L); full SPL execution enables high confidentiality and integrity impact with no availability disruption.
Primary rating from Vendor (cisco).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionNVD
In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. The vulnerability is possible because Splunk AI Toolkit gives the "power" Splunk role permission to modify scheduled searches that run using the permissions of the search owner.
AnalysisAI
Splunk AI Toolkit before version 6.0.1 allows authenticated users holding the built-in 'power' role to modify app-provided scheduled searches, which execute SPL under the permissions of the search owner rather than the modifying user. By injecting arbitrary SPL into such searches, a 'power' role user can access all data visible to the search owner and alter system integrity - effectively escalating privileges beyond their authorization level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated user holding the Splunk 'power' role on a Splunk instance with Splunk AI Toolkit version below 6.0.1 installed and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a network-accessible flaw with low attack complexity and a low privilege requirement - any user explicitly assigned the 'power' role can exploit this over a standard Splunk web session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A Splunk analyst with the 'power' role navigates to the Splunk AI Toolkit's scheduled search management interface and identifies a search owned by a Splunk administrator. The analyst modifies the search's SPL to include commands that exfiltrate sensitive index data to an external destination or alter key configuration lookups, then waits for the scheduled search to fire under the administrator's permissions. … |
| Remediation | Upgrade Splunk AI Toolkit to version 6.0.1 or later, which corrects the incorrect permission assignment for the 'power' role and prevents modification of app-provided scheduled searches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Splunk AI Toolkit instances in production to identify versions and assess data exposure scope based on 'power' role user access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today