In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary… (CVE-2026-76399)
Splunk AI Toolkit versions below 6.0.1 contain a vulnerability where users with the "power" Splunk role can modify scheduled searches provided by the app to execute arbitrary Search Processing Language (SPL) commands. This occurs because the "power" role has permission to alter scheduled searches that run with the search owner's permissions, potentially allowing unauthorized access to sensitive data and impacting system integrity.
AI Analysis
Technical Summary
In Splunk AI Toolkit versions prior to 6.0.1, a privilege misconfiguration allows users assigned the "power" Splunk role to modify app-provided scheduled searches. These scheduled searches execute with the permissions of their owners, so by altering them, an attacker can run arbitrary SPL commands under the owner's privileges. This vulnerability stems from the toolkit granting the "power" role the ability to modify scheduled searches, which can lead to unauthorized data access and compromise of system integrity. The CVSS 3.1 score is 8.1, indicating high severity.
Potential Impact
An attacker with the "power" Splunk role can execute arbitrary SPL queries with the permissions of the scheduled search owner. This can lead to unauthorized access to sensitive data and compromise system integrity. There is no indication of impact on availability. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in Splunk AI Toolkit version 6.0.1. Users should upgrade to version 6.0.1 or later to remediate this vulnerability. Until patched, restrict assignment of the "power" Splunk role to trusted users only.
In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary… (CVE-2026-76399)
Description
Splunk AI Toolkit versions below 6.0.1 contain a vulnerability where users with the "power" Splunk role can modify scheduled searches provided by the app to execute arbitrary Search Processing Language (SPL) commands. This occurs because the "power" role has permission to alter scheduled searches that run with the search owner's permissions, potentially allowing unauthorized access to sensitive data and impacting system integrity.
CVSS v3.1
Score 8.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Splunk AI Toolkit versions prior to 6.0.1, a privilege misconfiguration allows users assigned the "power" Splunk role to modify app-provided scheduled searches. These scheduled searches execute with the permissions of their owners, so by altering them, an attacker can run arbitrary SPL commands under the owner's privileges. This vulnerability stems from the toolkit granting the "power" role the ability to modify scheduled searches, which can lead to unauthorized data access and compromise of system integrity. The CVSS 3.1 score is 8.1, indicating high severity.
Potential Impact
An attacker with the "power" Splunk role can execute arbitrary SPL queries with the permissions of the scheduled search owner. This can lead to unauthorized access to sensitive data and compromise system integrity. There is no indication of impact on availability. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in Splunk AI Toolkit version 6.0.1. Users should upgrade to version 6.0.1 or later to remediate this vulnerability. Until patched, restrict assignment of the "power" Splunk role to trusted users only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-x8wf-gj49-q42j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-76399"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a870a80acd9273b49b597c7
Added to database: 08/20/2026, 14:09:04 UTC
Last enriched: 08/20/2026, 14:41:20 UTC
Last updated: 08/21/2026, 03:51:58 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.