Insecure Outbound Request Configuration in Splunk AI Toolkit
CVE-2026-20265

4.3MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Ai Toolkit
Vendor
CVE Published:
17 June 2026

What is CVE-2026-20265?

The vulnerability in the Splunk AI Toolkit arises from an insecure default domain allowlist, permitting low-privileged users without 'admin' or 'power' roles to initiate outbound HTTP requests to external servers controlled by attackers. This misconfiguration can lead to unauthorized data exfiltration, as the toolkit fails to restrict requests to trusted domains.

Affected Version(s)

Splunk AI Toolkit 5.7 < 5.7.4

References

https://advisory.splunk.com/advisories/SVD-2026-0613

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriel Nitu, Splunk
.