CVE-2026-76391: Splunk AI Toolkit Privilege Escalation

CVE-2026-76391 Overview

CVE-2026-76391 is an improper authorization vulnerability [CWE-863] affecting Splunk AI Toolkit versions below 6.0.0. The Agent Run History handler replaces the calling user's session key with a system authentication token before performing search operations. As a result, a low-privileged authenticated user who does not hold the admin or power Splunk role can execute searches with system-level privileges. Exploitation lets the attacker access all indexed data, affect system integrity, and read or delete search jobs belonging to other users. Splunk documented the flaw in Splunk Security Advisory SVD-2026-0808.

Critical Impact
A non-admin authenticated user can run searches as the system account, reading arbitrary data and manipulating other users' search jobs through the AI Toolkit Agent Run History.

Affected Products

Splunk AI Toolkit versions below 6.0.0
Splunk deployments using the AI Toolkit Agent Launchpad feature
Splunk Enterprise environments with the AI Toolkit app installed

Discovery Timeline

2026-08-19 - CVE-2026-76391 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76391

Vulnerability Analysis

The flaw resides in the Agent Run History handler within the Splunk AI Toolkit. When a user invokes the handler, the component substitutes the caller's authenticated session key with a system-level authentication token before dispatching search operations. Splunk then executes those searches under system context rather than the caller's context. This design short-circuits Splunk's role-based access control, allowing users without admin or power roles to perform actions reserved for privileged operators.

The scope of impact covers three areas. First, the attacker can query any index the system account can access. Second, the attacker can alter system integrity through search-driven side effects. Third, the attacker can read or delete search artifacts owned by other users, exposing sensitive investigation data and disrupting analyst workflows.

Root Cause

The root cause is improper privilege management classified under [CWE-863]. The handler substitutes the session token instead of authorizing the requested action against the caller's actual role. Splunk addressed the issue in AI Toolkit 6.0.0 by removing the token substitution behavior from the Agent Run History code path.

Attack Vector

An authenticated attacker with any non-privileged Splunk role sends crafted requests to the Agent Run History endpoint exposed by the AI Toolkit. The request is processed over the network against the Splunk management interface. No user interaction is required, and attack complexity is low. The attacker inherits system search capabilities and can enumerate or destroy search jobs belonging to other users.

No verified public proof-of-concept is available. Refer to Splunk Security Advisory SVD-2026-0808 for vendor technical details.

Detection Methods for CVE-2026-76391

Indicators of Compromise

Search audit events in _audit index showing searches attributed to the system user but originating from non-admin session contexts.
Unexpected access to search_jobs REST endpoints by users without admin or power roles.
Deletion or modification of search job artifacts under $SPLUNK_HOME/var/run/splunk/dispatch/ correlating with AI Toolkit Agent activity.

Detection Strategies

Review Splunk _internal and _audit logs for action=search events where the invoking user lacks admin privileges but the search runs with system-level user=splunk-system-user context.
Correlate Agent Run History handler invocations with the identity of the requesting session to detect role-context mismatches.
Baseline normal AI Toolkit usage per user role and alert on deviations, especially bulk search job reads or deletions.

Monitoring Recommendations

Enable verbose auditing on the AI Toolkit app and forward Splunk internal logs to a centralized analytics platform for correlation.
Monitor REST API calls to /services/search/jobs and AI Toolkit endpoints for anomalous access patterns from low-privileged accounts.
Track creation and deletion rates of search jobs per user and alert on statistical outliers.

How to Mitigate CVE-2026-76391

Immediate Actions Required

Upgrade the Splunk AI Toolkit app to version 6.0.0 or later on all Splunk instances where it is installed.
Inventory Splunk search heads and standalone instances to confirm the AI Toolkit version currently deployed.
Audit historical search and job activity for evidence of misuse of the Agent Run History handler prior to patching.

Patch Information

Splunk released AI Toolkit 6.0.0 to remediate the improper privilege management. The fixed release removes the substitution of the caller's session key with a system authentication token in the Agent Run History code path. See Splunk Security Advisory SVD-2026-0808 for the authoritative fix guidance.

Workarounds

If immediate upgrade is not feasible, uninstall or disable the Splunk AI Toolkit app on affected instances.
Restrict access to the AI Toolkit app using Splunk role capabilities so that only trusted administrators can invoke Agent Run History.
Limit which users hold accounts on affected search heads and enforce least privilege on Splunk role assignments.

bash

# Disable the Splunk AI Toolkit app pending upgrade
cd $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit
# Edit local/app.conf to set the app to disabled
printf "[install]\nstate = disabled\n" > local/app.conf
$SPLUNK_HOME/bin/splunk restart