In Splunk AI Toolkit versions prior to 6.0.0, a race condition exists where concurrent model upload requests with the same model name can interfere with each other. The toolkit does not verify that the uploaded content corresponds to the request that creates the model lookup entry, allowing an attacker with upload permissions to overwrite another user's model upload. This results in the model lookup entry pointing to attacker-controlled content, potentially impacting integrity and availability of the model data.

An attacker with the ability to upload models can cause the model lookup entry to reference malicious or attacker-controlled content by exploiting the race condition. This can lead to integrity compromise of the model data and potentially affect the availability of legitimate models. The CVSS score of 5.9 (medium severity) reflects limited attack complexity but requires low privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict model upload permissions to trusted users only and avoid concurrent uploads of models with the same name. Monitor Splunk's official documentation and advisories for updates regarding a fix or official mitigation.