CVE-2026-76395: The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. in Splunk Splunk AI Toolkit

In Splunk AI Toolkit versions >=5.7 and <6.0.0, a deserialization vulnerability exists due to insufficient validation of sparse matrix data during model file loading. A user with the 'power' role can exploit this by crafting a model file with malicious pickle content embedded in sparse matrix data, leading to arbitrary code execution on the server. The vulnerability arises from the model codec's unsafe deserialization process that does not properly verify the integrity or safety of the data being deserialized.

An attacker with the 'power' role in Splunk can execute arbitrary code on the Splunk server, potentially leading to full compromise of the affected system. This impacts confidentiality, integrity, and availability of the server and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assignment of the 'power' role to trusted users only and avoid loading untrusted model files containing sparse matrix data.