In Splunk AI Toolkit versions below 6.0.0, specifically version 5.7, an authorization bypass vulnerability exists due to improper privilege management. The Agent Run History handler replaces the calling user's session key with a system authentication token prior to performing search operations. This flaw allows users lacking the 'admin' or 'power' roles to execute searches with elevated system-level privileges, access all relevant data, affect system integrity, and manipulate search jobs of other users. The vulnerability is documented under CVE-2026-76391 with a CVSS 3.1 score of 8.3 (high severity).

An attacker with a non-privileged Splunk role can bypass intended access restrictions to run searches with system-level privileges. This enables unauthorized access to sensitive data, potential modification or deletion of other users' search jobs, and compromises system integrity. The vulnerability undermines role-based access controls within the affected Splunk AI Toolkit version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Splunk's official documentation and update to version 6.0.0 or later when available, as the vulnerability affects versions below 6.0.0. Until a patch is applied, restrict access to the affected Splunk AI Toolkit version to trusted users only.