Description

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedule_search capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply search command as risky. For more information see Troubleshoot the AI Toolkit (https://help.splunk.com/en/splunk-enterprise/apply-machine-learning/use-ai-toolkit/5.7.3/troubleshooting-the-ai-toolkit/troubleshoot-the-ai-toolkit) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T22:17:26.150Z",
  "pubdate": "2026-08-19T22:17:26.150Z",
  "executiveSummary": "An improper access control vulnerability exists in the Splunk AI Toolkit in versions below 6.0.0, classified as an insecure deserialization issue involving risky search commands. The vulnerability allows an authenticated attacker holding a role with the schedule_search capability to execute arbitrary model loading and deserialization routines via the apply search command. The impact of this security flaw includes potential arbitrary code execution or system compromise within the Splunk environment. The affected system is the Splunk AI Toolkit running on vulnerable versions below 6.0.0. Exploitation requires the attacker to possess the schedule_search capability and leverage the unmarked risky command to process malicious model files. This poses significant risk implications regarding unauthorized system access and privilege escalation within the platform.",
  "technicalDetails": "The root cause of the vulnerability stems from improper access control and inadequate command classification within the Splunk AI Toolkit. Specifically, the application fails to designate the apply search command as a risky command. In Splunk architecture, commands that interact with external files, perform deserialization, or execute complex machine learning logic must be explicitly marked as risky to prevent unauthorized or privileged abuse.\nThe affected component is the apply search command provided by the Splunk AI Toolkit across versions below 6.0.0. Authentication and privilege requirements mandate that the attacker holds a role assigned with the schedule_search capability. Network exposure is constrained by the Splunk instance's access controls, but internal privilege boundaries are bypassed due to the missing risk classification.\nThe attack flow proceeds as follows: First, an attacker with the schedule_search capability crafts or references a malicious model file designed to exploit insecure deserialization mechanics. Second, the attacker configures or executes a scheduled search leveraging the apply search command to process the targeted model file. Third, because the apply search command lacks the appropriate risky designation, the search execution engine processes the command without triggering standard administrative restrictions or security warnings associated with risky operations. Finally, the scheduled search loads and deserializes the malicious model file, resulting in the execution of the embedded payload within the context of the Splunk process, leading to potential post-exploitation impact such as code execution or unauthorized data access."
}