CVE-2026-76394: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk AI Toolkit

In Splunk AI Toolkit versions >=5.7 and <6.0.0, multiple REST API handlers do not enforce authorization checks, enabling low-privileged users lacking admin or power roles to perform unauthorized actions such as starting, stopping, and configuring containers, as well as reading or modifying connection and configuration data. This lack of authorization enforcement exposes sensitive operations to unauthorized users.

An attacker with low privileges can manipulate container operations and access or alter configuration data, potentially leading to unauthorized configuration changes, service disruption, and information disclosure. The CVSS 3.1 score of 8.3 reflects high impact with low attack complexity and no user interaction required.

The vulnerability affects Splunk AI Toolkit versions prior to 6.0.0. Users should upgrade to version 6.0.0 or later where authorization checks are enforced. Since no patch links or vendor advisory are provided, confirm remediation status with Splunk's official resources. Until patched, restrict access to the REST API to trusted users only.