CVE-2026-76396: Splunk AI Toolkit Privilege Escalation

CVE-2026-76396 Overview

CVE-2026-76396 affects Splunk AI Toolkit versions below 6.0.0. A user holding a role with the schedule_search capability can cause a scheduled search to load and deserialize a model file through the apply search command. The Splunk AI Toolkit does not mark the apply command as risky, resulting in improper access control [CWE-269]. This gap allows lower-privileged users to trigger deserialization of untrusted model files during scheduled search execution.

Critical Impact
A low-privileged Splunk user with scheduling rights can trigger deserialization of a model file through a scheduled search, exposing confidentiality, integrity, and availability of the Splunk environment.

Affected Products

Splunk AI Toolkit versions below 6.0.0
Splunk Enterprise deployments running the AI Toolkit app
Splunk Cloud instances running the AI Toolkit app

Discovery Timeline

2026-08-19 - CVE-2026-76396 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76396

Vulnerability Analysis

The Splunk AI Toolkit provides the apply search command to load a previously trained machine learning model and evaluate new data against it. Loading a model requires deserializing the stored model file. In versions below 6.0.0, the toolkit does not flag apply as a risky command. Risky-command marking is the mechanism Splunk uses to require elevated capabilities before a command runs in a scheduled or shared context.

Because the check is missing, a user who only holds the schedule_search capability can create a scheduled search that invokes apply. When the scheduler executes that job, the deserialization occurs in the context of the search process. Attacker-supplied or attacker-influenced model artifacts can therefore be loaded outside the trust boundary the toolkit assumes.

Root Cause

The root cause is improper access control [CWE-269] combined with unsafe deserialization of model files. The apply command lacks the risky-command designation, so Splunk's built-in gating for capability-restricted operations never runs. Any principal with schedule_search inherits an implicit path to deserialization behavior normally reserved for higher-privileged roles.

Attack Vector

The attack requires network access to the Splunk web or REST interface and valid credentials for a role that includes schedule_search. The attacker stages or references a model file, schedules a search that calls apply against that model, and waits for the scheduler to run the job. Deserialization occurs during the scheduled execution. Exploitation is remote but requires authenticated low-privileged access and non-trivial preconditions around model placement. See the Splunk Security Advisory SVD-2026-0808 for vendor detail.

Detection Methods for CVE-2026-76396

Indicators of Compromise

Scheduled searches created by non-admin users that invoke the apply command in the AI Toolkit.
Unexpected model files (.mlmodel or serialized model artifacts) appearing in AI Toolkit lookup or model directories.
Scheduler audit events showing apply executions tied to roles that hold only schedule_search.

Detection Strategies

Audit savedsearches.conf and the /services/saved/searches REST endpoint for search strings containing | apply created or modified by low-privileged users.
Correlate Splunk _audit and scheduler.log events with role membership to identify apply executions outside expected data-science workflows.
Baseline which users legitimately use the AI Toolkit and alert on deviations, especially new model file writes preceding scheduled apply calls.

Monitoring Recommendations

Forward Splunk internal indexes (_audit, _internal) to a centralized analytics platform for role-versus-command correlation.
Monitor filesystem writes to AI Toolkit model directories on search heads and alert on unexpected authors or timestamps.
Track creation of new scheduled searches referencing machine learning commands and require review before enabling.

How to Mitigate CVE-2026-76396

Immediate Actions Required

Upgrade the Splunk AI Toolkit to version 6.0.0 or later on all search heads.
Review and remove the schedule_search capability from roles that do not require it.
Inventory existing scheduled searches that call apply and disable any that are not explicitly authorized.

Patch Information

Splunk resolved the issue in Splunk AI Toolkit version 6.0.0. Refer to the Splunk Security Advisory SVD-2026-0808 for the fixed version matrix and upgrade instructions. Splunk Cloud customers should coordinate with Splunk support to confirm that their stack has been updated.

Workarounds

Restrict the schedule_search capability to trusted administrative roles until the upgrade is applied.
Disable or uninstall the AI Toolkit app on search heads where machine learning workflows are not required.
Apply filesystem controls that prevent non-administrator users from writing model files into AI Toolkit directories.

bash

# Example: list roles that currently hold schedule_search
# Run against a Splunk search head as an admin
| rest /services/authorization/roles \
| search capabilities=schedule_search \
| table title capabilities

# Example: find scheduled searches invoking the apply command
| rest /services/saved/searches \
| search is_scheduled=1 search="*| apply *" \
| table title author search next_scheduled_time