Remote Command Execution in Splunk AI Toolkit by Splunk

CVE-2026-20266

What is CVE-2026-20266?

The Splunk AI Toolkit, particularly in versions prior to 5.7.4, is susceptible to a vulnerability that allows users with admin privileges to execute arbitrary operating system commands on the host machine running Splunk Enterprise. This flaw arises from an insecure shell execution mechanism in the btool configuration helper, which improperly constructs command strings using dynamic parameters without adequate safeguards against shell interpretation. This oversight poses a significant security risk, potentially enabling unauthorized access and control over the host system.

References