In Splunk AI Toolkit versions below 6.0.0, including version 5.7, multiple REST API handlers do not enforce authorization checks. This allows low-privileged users lacking admin or power roles to perform unauthorized actions such as starting, stopping, and configuring containers, as well as reading or modifying connection and configuration data. The vulnerability arises from missing authorization enforcement in the REST API, leading to potential unauthorized access and modification of sensitive operational data.

An attacker with low-privileged Splunk roles can perform unauthorized actions on containers and configuration data, potentially leading to unauthorized configuration changes, service disruption, and information disclosure. The impact includes limited confidentiality loss (C:L), high integrity impact (I:H), and high availability impact (A:H) as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Splunk AI Toolkit REST API to trusted users only and monitor for unusual activity. Follow Splunk's documentation on troubleshooting and securing the Machine Learning Toolkit for potential interim mitigations.