CVE-2026-76394: Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit
In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer (REST) API. The missing authorization is possible because multiple REST API handlers in Splunk AI Toolkit do not enforce authorization checks. For more information see Troubleshoot the Splunk Machine Learning Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/machine-learning-toolkit-user-guide/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) in the Splunk documentation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any low-privileged Splunk user who lacks both the "admin" and "power" roles can exploit the affected REST API handlers. Exploitation is network-accessible and does not require user interaction.
What access does exploitation provide?
An affected user can start, stop, and configure containers. They can also read or modify connection data and configuration data through the REST API.
Which versions are affected?
Splunk AI Toolkit versions below 6.0.0 are affected. Version 6.0.0 is not identified as affected by the provided advisory information.
How can I determine whether my environment is exposed?
Check whether the Splunk AI Toolkit version is below 6.0.0 and whether low-privileged users can access the toolkit's REST API. Review REST API activity for container lifecycle or configuration changes performed by accounts without the "admin" or "power" roles.