CVE-2026-76392: Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit
In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for connected container services using predictable or hard-coded default values. For more information see Connections tab in the AI Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.7.2/ai-toolkit-commands-macros-and-visualizations/connections-tab-in-the-ai-toolkit) in the Splunk documentation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who lacks both the Splunk "admin" and "power" roles can obtain predictable or default credentials for connected container services. Exploitation requires access to Splunk with such a user account; the vector is network-based and requires low privileges.
Which deployments are affected?
Splunk AI Toolkit versions below 6.0.0 are affected. The issue concerns deployments using connected container services through the AI Toolkit.
What is the impact if the credentials are obtained?
The vulnerability has low confidentiality and integrity impact. It does not have an availability impact according to the supplied CVSS vector.