CVE-2026-76399: Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit
In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. The vulnerability is possible because Splunk AI Toolkit gives the "power" Splunk role permission to modify scheduled searches that run using the permissions of the search owner.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the Splunk "power" role can exploit it in affected Splunk AI Toolkit versions by modifying app-provided scheduled searches.
What access does an attacker need, and is user interaction required?
The attacker needs an authenticated Splunk account assigned the "power" role. No user interaction is required.
What could an attacker do by exploiting it?
They could replace the scheduled search logic with arbitrary SPL that runs using the search owner's permissions. This could expose all data available to that owner and affect system integrity.
Which versions are affected?
Splunk AI Toolkit versions below 6.0.1 are affected.
What configuration condition makes the issue possible?
The issue occurs because the Splunk AI Toolkit grants the "power" role permission to modify scheduled searches that execute under the search owner's permissions.