Description

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope when it processes caller-controlled query values before accessing restricted history data. For more information see Experiment Assistants (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.6.4/experiment-assistants) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T22:17:26.270Z",
  "pubdate": "2026-08-19T22:17:26.270Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Splunk AI Toolkit affecting versions below 6.0.0. The vulnerability allows users assigned the \"power\" Splunk role to access and delete all relevant data within the experiment history, including data explicitly associated with other users. This security flaw introduces significant risk regarding data confidentiality and integrity within multi-tenant or multi-user Splunk environments, as lower-privileged administrative users can manipulate unauthorized historical records.\nThe root of the issue lies in improper handling of caller-controlled query values, which fail to preserve trusted experiment scopes during access operations to restricted history data. Exploitation requires authenticated access with the \"power\" role within the Splunk environment. Attackers possessing this role can leverage crafted query parameters to interact with and purge experiment data outside their authorized scope, leading to unauthorized data destruction and information exposure.",
  "technicalDetails": "The vulnerability resides within the experiment history processing mechanism of the Splunk AI Toolkit for versions below 6.0.0. The vulnerable component fails to adequately enforce authorization boundaries when processing caller-controlled query values.\nThe root cause is the failure to preserve the trusted experiment scope during internal processing routines that handle queries destined for restricted history data repositories. When a request containing caller-controlled query values is processed, the application does not cryptographically or logically validate whether the requesting user context holds direct ownership or explicit authorization over the target experiment history records.\nThe authentication requirement dictates that the attacker must possess a valid user session within the Splunk platform. Specifically, the attacker must hold the \"power\" Splunk role. Despite this role being restricted from accessing arbitrary users' private data under normal application logic, the lack of input validation and scope enforcement allows the privilege boundary to be bypassed.\nThe attack flow proceeds as follows: First, an authenticated attacker with the \"power\" role formulates an HTTP request or API call containing specially manipulated caller-controlled query values targeting the experiment history feature. Second, the Splunk AI Toolkit processes the incoming query without verifying the trusted experiment scope or validating user ownership boundaries. Third, the backend application executes the data retrieval or deletion command across the global dataset rather than isolating it to the caller's authorized context. Finally, the attacker achieves unauthorized access to view, modify, or permanently delete experiment history data belonging to other users across the system, resulting in severe data integrity violations and loss of historical machine learning artifacts."
}