CVE-2026-76399: Splunk AI Toolkit Privilege Escalation

CVE-2026-76399 Overview

CVE-2026-76399 affects Splunk AI Toolkit versions below 6.0.1. A user holding the power Splunk role can modify app-provided scheduled searches that execute using the search owner's permissions. This allows the attacker to run arbitrary Search Processing Language (SPL) with elevated privileges. The flaw stems from overly permissive access control [CWE-732] on scheduled search objects within the toolkit. Successful exploitation grants access to all data visible to the search owner and enables tampering with system integrity. The vulnerability requires network access and low-privilege authentication but no user interaction.

Critical Impact
Authenticated power role users can execute arbitrary SPL under the search owner's context, exposing sensitive indexed data and enabling integrity compromise across the Splunk environment.

Affected Products

Splunk AI Toolkit versions below 6.0.1
Splunk deployments where the AI Toolkit app is installed
Environments granting the power role to non-administrative users

Discovery Timeline

2026-08-19 - CVE-2026-76399 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76399

Vulnerability Analysis

The vulnerability resides in how Splunk AI Toolkit configures permissions on its app-provided scheduled searches. Scheduled searches in Splunk can run with either the invoking user's permissions or the search owner's permissions. When configured to run as the owner, the search inherits that owner's data access and capabilities.

The AI Toolkit grants the power role write access to these scheduled search objects. A power user does not normally hold administrative privileges. However, by modifying the SPL contained in an owner-scoped scheduled search, a power user causes arbitrary SPL to execute with the owner's higher permissions on the next schedule tick. This yields access to indexes and lookups the attacker could not otherwise query.

Root Cause

The root cause is an incorrect permission assignment for a critical resource [CWE-732]. The AI Toolkit ships scheduled search configurations that combine two dangerous properties: dispatchAs = owner and write ACLs that include the power role. This combination permits privilege escalation whenever the search owner holds broader access than the modifying user.

Attack Vector

Exploitation requires an authenticated session with the power role on a Splunk instance running a vulnerable AI Toolkit version. The attacker edits an existing app-provided scheduled search through the Splunk web UI or the REST API, replacing the SPL body with attacker-controlled commands. When the schedule fires, the modified SPL runs under the original owner's identity, returning results or performing actions such as writing to KV stores or triggering alert actions.

No verified proof-of-concept code is publicly available. Refer to the Splunk Security Advisory SVD-2026-0808 for vendor-provided technical detail.

Detection Methods for CVE-2026-76399

Indicators of Compromise

Unexpected modifications to scheduled searches under the Splunk AI Toolkit app namespace, particularly changes to the search stanza in savedsearches.conf.
Scheduled search executions producing result volumes or index access patterns inconsistent with the original search intent.
REST API calls to /servicesNS/<user>/Splunk_ML_Toolkit/saved/searches/ from accounts holding only the power role.

Detection Strategies

Audit _audit and _internal indexes for action=edit events targeting saved searches within the AI Toolkit app, filtered by users without administrative roles.
Compare current savedsearches.conf contents against known-good baselines from the shipped app package to detect unauthorized SPL changes.
Alert on scheduled searches where dispatchAs=owner and the last editor differs from the owner and lacks the admin role.

Monitoring Recommendations

Enable and forward Splunk audit logs to a centralized analytics platform for correlation across users, roles, and configuration objects.
Monitor role assignments and capability grants for the power role, alerting on additions to sensitive apps.
Track scheduled search runtime behavior for sudden expansions in data volume, new index access, or new output destinations.

How to Mitigate CVE-2026-76399

Immediate Actions Required

Upgrade Splunk AI Toolkit to version 6.0.1 or later on all Splunk search head instances where the app is installed.
Inventory all users assigned the power role and remove the assignment from accounts that do not require it.
Review app-provided scheduled searches for unauthorized modifications and restore them from the shipped defaults if tampering is suspected.

Patch Information

Splunk addressed this issue in Splunk AI Toolkit 6.0.1. Details are published in the Splunk Security Advisory SVD-2026-0808. Apply the fixed version through Splunkbase or the Splunk app management interface, then restart the search head to load updated permission definitions.

Workarounds

Restrict write access to AI Toolkit scheduled searches by modifying default.meta or local.meta to remove write permissions for the power role.
Change affected scheduled searches to run with dispatchAs = user where operationally acceptable, eliminating the privilege differential.
Disable non-essential app-provided scheduled searches until the patched version is deployed.

bash

# Example metadata override to remove power role write access
# Place in $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit/metadata/local.meta
[savedsearches]
access = read : [ * ], write : [ admin ]
export = system