CVE-2026-76391: The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. in Splunk Splunk AI Toolkit

In Splunk AI Toolkit versions >=5.7 and <6.0.0, an authorization bypass vulnerability exists due to improper privilege management in the Agent Run History handler. The handler replaces the calling user's session key with a system authentication token before performing search operations, enabling users lacking admin or power roles to run searches with elevated system-level privileges. This flaw allows unauthorized access to data, impacts system integrity, and permits reading or deletion of search jobs belonging to other users.

Attackers without elevated roles can perform searches with system-level privileges, leading to unauthorized data access, potential data manipulation, and deletion of other users' search jobs. This compromises confidentiality, integrity, and availability of the affected system components.

A fix is available in Splunk AI Toolkit version 6.0.0 and later. Users should upgrade to version 6.0.0 or above to remediate this vulnerability. No other mitigation guidance is provided in the vendor documentation.