Improper Access Control in Splunk AI Toolkit Allows Unauthenticated User Actions

CVE-2026-76396

What is CVE-2026-76396?

In versions prior to 6.0.0 of the Splunk AI Toolkit, an improper access control vulnerability exists that allows users with the schedule_search capability to trigger a scheduled search that inadvertently loads and deserializes a model file via the apply search command. This is due to the lack of appropriate risk markings on the apply search command, potentially leading to exploitation by unauthorized users who can manipulate scheduled searches to access sensitive data or execute unwanted commands. For more details, refer to the official Splunk documentation.

References