Description

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit deserializes sparse matrix data without guarding against embedded pickle content. For more information see Troubleshoot the Splunk Machine Learning Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/machine-learning-toolkit-user-guide/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:26.023Z",
  "pubdate": "2026-08-19T22:17:26.023Z",
  "executiveSummary": "A remote code execution vulnerability exists in the Splunk AI Toolkit affecting versions below 6.0.0. The vulnerability stems from insecure deserialization within a model codec that processes sparse matrix data without implementing adequate safeguards against embedded pickle payloads. An authenticated attacker possessing the \"power\" Splunk role can leverage this flaw by uploading a specially crafted model file containing malicious serialized data. Successful exploitation permits the execution of arbitrary code within the context of the Splunk server, leading to a complete compromise of the underlying host operating system and associated data confidentiality, integrity, and availability. The attack requires authenticated access with specific privilege levels, specifically the \"power\" role, and relies on the interaction with the vulnerable model loading mechanism.",
  "technicalDetails": "The vulnerability resides in the Splunk AI Toolkit model codec component, specifically in the handling and parsing of sparse matrix data structures across versions below 6.0.0. The root cause of the security defect is the unsafe deserialization of untrusted input. The application utilizes mechanisms that process Python pickle content or equivalent object serialization structures embedded within the sparse matrix data without validating the contents or sanitizing the input against malicious code constructs.\nThe attack flow proceeds as follows: First, an attacker authenticates to the Splunk platform with credentials possessing the \"power\" Splunk role. Second, the attacker crafts a malicious model file containing specially structured sparse matrix data designed to carry an embedded arbitrary code payload via insecure deserialization. Third, the attacker uploads or loads the crafted model file into the Splunk AI Toolkit via the standard application interface. Fourth, the vulnerable model codec parses the file and automatically deserializes the untrusted sparse matrix data without adequate security boundaries.\nDuring the deserialization process, the embedded payload executes within the runtime environment of the Splunk server process. Because the execution inherits the privileges of the hosting application context, the attacker achieves arbitrary code execution on the server. The impact includes full post-exploitation control over the affected system, enabling the attacker to execute arbitrary system commands, access sensitive system files, manipulate data, or pivot to other network segments depending on the host configuration and network exposure."
}