Description

In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The race condition is possible because Splunk AI Toolkit does not verify that the uploaded content belongs to the request that creates the model lookup entry. For more information see Troubleshoot the Splunk Machine Learning Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/machine-learning-toolkit-user-guide/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-19T22:17:25.737Z",
  "pubdate": "2026-08-19T22:17:25.737Z",
  "executiveSummary": "A race condition vulnerability exists in the Splunk AI Toolkit in versions below 6.0.0. The vulnerability allows an authenticated user with model upload capabilities to overwrite a model currently being uploaded by another user. By timing a concurrent upload request with the exact same target model name, an attacker can manipulate the resulting model lookup entry to reference attacker-controlled content.\nThe primary impact of this security flaw is integrity and potential execution compromise, as malicious or unauthorized model content is bound to legitimate lookup references within the application. The risk implications include the potential execution of untrusted or malicious machine learning models within the environment.\nTo successfully exploit this vulnerability, an attacker requires privileges to upload models to the affected Splunk AI Toolkit instance. The exploitation relies on precise timing and concurrency to intercept and replace the model lookup entry association during the upload lifecycle, as the application fails to cryptographically or logically bind the uploaded content payload to the specific instantiation request.",
  "technicalDetails": "The root cause of the vulnerability resides in a race condition within the model upload and lookup creation logic of the Splunk AI Toolkit. Specifically, the application fails to verify that the uploaded content stream strictly belongs to the specific HTTP request that initializes and creates the corresponding model lookup entry.\nThe vulnerable component involves the model upload management and lookup registration handlers in Splunk AI Toolkit versions below 6.0.0. The authentication requirement is authenticated access, and the privilege requirement is the ability to upload models. The network exposure encompasses any interface exposed by Splunk allowing model management interactions.\nThe step-by-step attack flow proceeds as follows: First, a legitimate user initiates an upload request for a model with a specific target name. Second, while the initial upload is in-flight or processing, an attacker sends a concurrent upload request utilizing the identical target model name, providing malicious or arbitrary attacker-controlled model data.\nDue to the absence of strict validation, locking, or request-to-content binding mechanisms, the backend processing logic associates the attacker-supplied payload with the lookup entry expected by the legitimate user. Consequently, the resulting model lookup entry references the attacker-controlled content rather than the legitimate artifact.\nPost-exploitation impact includes the integration of untrusted model files into operational machine learning workflows, which can subsequently be loaded and executed by the platform, potentially leading to unauthorized data processing outcomes or further exploitation depending on how the consuming application parses and executes the uploaded model artifacts."
}