CVE-2026-76397 in AI Toolkit
Summary
by MITRE • 08/20/2026
In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope when it processes caller-controlled query values before accessing restricted history data. For more information see Experiment Assistants (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.6.4/experiment-assistants) in the Splunk documentation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Splunk AI Toolkit versions prior to 6.0.0 represents a critical failure in access control mechanisms, specifically manifesting as an Insecure Direct Object Reference or Broken Access Control issue. This flaw allows users with the standard power role within the Splunk environment to bypass intended security boundaries and interact with data belonging to other users. The core of the vulnerability lies in how the application handles experiment history data associated with AI experiments. Under normal operational parameters, a user should only be able to view or modify their own experimental data. However, due to insufficient validation logic within the toolkit's backend processing, this restriction is effectively nullified for power role holders.
The technical root cause of this vulnerability stems from the application's failure to preserve and enforce trusted experiment scope when processing caller-controlled query values. When a user initiates an action such as viewing or deleting data related to an experiment history entry, the system accepts input parameters that define which specific records are targeted for retrieval or deletion. Instead of validating these inputs against the authenticated user's authorized dataset boundaries, the toolkit relies on the provided identifiers without sufficient cross-referencing with access control lists or ownership metadata. This lack of server-side authorization checks means that if a power role user manipulates query parameters to reference experiment IDs belonging to other users, the system processes the request as valid and executes the operation.
The operational impact of this vulnerability is severe, particularly in multi-tenant Splunk Cloud environments where data isolation between different teams or departments is essential for compliance and security. An attacker with power role privileges can not only view sensitive information contained within another user's experiment history but also permanently delete it. This capability leads to a complete loss of integrity for the affected experimental data. Furthermore, because AI experiments often involve proprietary algorithms, training datasets, and model configurations, unauthorized access or deletion could result in significant intellectual property theft or operational disruption. The ability to delete data without authorization also undermines audit trails and forensic capabilities, as critical evidence may be erased before security teams can investigate potential breaches.
This vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, which describe scenarios where a user is able to perform actions or access resources beyond their assigned permissions. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts, specifically when an attacker leverages legitimate credentials with elevated privileges to move laterally and exfiltrate data. It also touches upon T1485 Data Destruction, as the ability to delete experiment history constitutes a malicious action that impacts system availability and integrity by removing critical operational records.
To mitigate this vulnerability, organizations running Splunk AI Toolkit versions below 6.0.0 must immediately upgrade to version 6.0.0 or later, where these access control checks have been corrected to properly enforce scope isolation based on user identity rather than just input parameters. Until the update is applied, administrators should consider restricting the power role privileges for users who do not strictly require them, thereby limiting the pool of potential attackers capable of exploiting this flaw. Additionally, implementing strict monitoring and alerting around experiment history deletion events can help detect any unauthorized access attempts in real-time, allowing security teams to respond quickly to potential data loss incidents. Regular audits of user roles and permissions are also recommended to ensure that privilege escalation paths remain minimized across the Splunk infrastructure.