CVE-2026-76396: The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. in Splunk Splunk AI Toolkit

In Splunk AI Toolkit versions >=5.7 and <6.0.0, a user assigned a role with the schedule_search capability can exploit improper access control by triggering a scheduled search that loads and deserializes a model file through the apply search command. The root cause is that the apply search command is not marked as risky, which leads to an unintended sphere of control for the actor. This vulnerability is tracked as CVE-2026-76396 and has a CVSS v3.1 score of 7.5, indicating high severity.

An attacker with schedule_search capability can execute actions that load and deserialize model files, potentially leading to full confidentiality, integrity, and availability compromise of the affected system. This improper privilege assignment can allow unauthorized control over scheduled searches and model execution within the Splunk AI Toolkit.

No explicit patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict roles with schedule_search capability to trusted users only and monitor scheduled searches for unusual activity.