CVE-2026-76392: The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. in Splunk Splunk AI Toolkit
Splunk AI Toolkit versions below 6.0.0, specifically version 5.7, contain hard-coded or predictable credentials used for connected container services. Users without admin or power roles can obtain these credentials, potentially compromising authentication or communication security. The vulnerability has a medium severity rating with a CVSS score of 5.4.
AI Analysis
Technical Summary
CVE-2026-76392 describes a vulnerability in Splunk AI Toolkit version 5.7 where hard-coded or predictable credentials are used for inbound authentication, outbound communication, or encryption of internal data related to connected container services. This allows users without elevated privileges (non-admin/non-power roles) to obtain these credentials, potentially undermining the security of these services. The issue arises because the toolkit generates or stores credentials using predictable or default values. No official patch or remediation level has been stated in the available data.
Potential Impact
The vulnerability allows users with limited privileges to access predictable or default credentials for connected container services, which could lead to unauthorized access or manipulation of these services. The impact is rated as medium, affecting confidentiality and integrity but not availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Splunk AI Toolkit and monitor for unauthorized use of container service credentials. Avoid deploying version 5.7 in sensitive environments if possible.
CVE-2026-76392: The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. in Splunk Splunk AI Toolkit
Description
Splunk AI Toolkit versions below 6.0.0, specifically version 5.7, contain hard-coded or predictable credentials used for connected container services. Users without admin or power roles can obtain these credentials, potentially compromising authentication or communication security. The vulnerability has a medium severity rating with a CVSS score of 5.4.
CVSS v3.1
Score 5.4medium
Affected software
pkg:github/splunk/splunk-ai-toolkitRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76392 describes a vulnerability in Splunk AI Toolkit version 5.7 where hard-coded or predictable credentials are used for inbound authentication, outbound communication, or encryption of internal data related to connected container services. This allows users without elevated privileges (non-admin/non-power roles) to obtain these credentials, potentially undermining the security of these services. The issue arises because the toolkit generates or stores credentials using predictable or default values. No official patch or remediation level has been stated in the available data.
Potential Impact
The vulnerability allows users with limited privileges to access predictable or default credentials for connected container services, which could lead to unauthorized access or manipulation of these services. The impact is rated as medium, affecting confidentiality and integrity but not availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Splunk AI Toolkit and monitor for unauthorized use of container service credentials. Avoid deploying version 5.7 in sensitive environments if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2026-08-19T12:02:03.631Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a862260acd9273b49a70479
Added to database: 08/19/2026, 21:38:40 UTC
Last enriched: 08/19/2026, 21:53:50 UTC
Last updated: 08/19/2026, 22:12:10 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.