Description

In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer (REST) API. The missing authorization is possible because multiple REST API handlers in Splunk AI Toolkit do not enforce authorization checks. For more information see Troubleshoot the Splunk Machine Learning Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/machine-learning-toolkit-user-guide/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-19T22:17:25.870Z",
  "pubdate": "2026-08-19T22:17:25.870Z",
  "executiveSummary": "A missing authorization vulnerability exists in the Splunk AI Toolkit in versions below 6.0.0. The vulnerability arises because multiple Representational State Transfer (REST) API handlers fail to enforce proper authorization checks, allowing low-privileged users lacking the 'admin' or 'power' Splunk roles to interact with sensitive application features. The impact of this security flaw includes unauthorized container lifecycle management (starting, stopping, and configuring containers) as well as the ability to read or modify critical connection and configuration data. The risk implication is significant, as unauthorized individuals can compromise the integrity and confidentiality of the machine learning infrastructure and connected data sources. The attacker capabilities involve executing privileged REST API operations despite possessing only low-privileged credentials within the Splunk environment. Exploitation requirements are limited to possessing valid user authentication with lower privilege levels than required for administrative or power roles, coupled with network access to the vulnerable Splunk instance and its REST API endpoints.",
  "technicalDetails": "The vulnerability is rooted in an access control flaw within the Splunk AI Toolkit codebase, specifically residing in multiple Representational State Transfer (REST) API handlers. The root cause is the complete absence of rigorous authorization checks prior to processing requests destined for sensitive operational endpoints. In a secure architecture, these handlers should validate that the authenticated session possesses either the 'admin' or 'power' Splunk roles before servicing administrative commands. Because these validations are omitted, any authenticated principal can invoke the endpoints regardless of their role assignment.\nThe affected components are the REST API handlers responsible for managing containerized workloads and manipulating connection and configuration data within the Splunk AI Toolkit. Affected versions comprise all releases of the Splunk AI Toolkit below version 6.0.0. The exploitation method relies on sending crafted HTTP requests directly to the unprotected REST API endpoints over the network. Authentication is required in the sense that the threat actor must possess a valid, low-privileged user session to interact with the API, but the vulnerability completely bypasses privilege requirements once that initial authentication boundary is crossed.\nThe step-by-step attack flow proceeds as follows: First, an attacker authenticates to the Splunk platform using a low-privileged user account that lacks the 'admin' and 'power' roles. Second, the attacker formulates HTTP requests targeting the vulnerable Representational State Transfer (REST) API endpoints exposed by the Splunk AI Toolkit. These requests may target functionalities designed to start, stop, or configure backend containers, or attempt to read and modify sensitive connection parameters and configuration files. Third, because the vulnerable REST API handlers fail to validate the user's role against the required access control lists (ACLs), the backend application processes the instructions. Finally, the server executes the administrative tasks and returns the requested configuration data or confirms container state modifications to the low-privileged attacker.\nThe post-exploitation impact includes full container orchestration manipulation within the scope of the toolkit, potentially allowing execution of arbitrary container configurations, denial of service by stopping operational containers, and exposure or tampering of sensitive connection credentials and configuration states."
}