CVE-2026-76393 Race Condition during Model Upload through the REST API in Splunk AI Toolkit
An attacker can overwrite another user's model upload via a race condition in the REST API, causing the system to reference attacker-controlled content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-76393?
CVE-2026-76393 is a medium-severity vulnerability in Splunk AI Toolkit, published on 19 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The race condition is possible because Splunk AI Toolkit does not verify that the uploaded content belongs to the request that creates the model lookup entry. For more information see Troubleshoot the Splunk Machine Learning Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/machine-learning-toolkit-user-guide/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) in the Splunk documentation.
Weakness: CWE-362
Which versions are affected by CVE-2026-76393?
It affects 1 product.
Products include Splunk Ai Toolkit.
How do I fix CVE-2026-76393?
No fix has been published for CVE-2026-76393 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-76393 being exploited?
There is no known exploitation of CVE-2026-76393 in the wild and no public exploit code.
Other vulnerabilities in Splunk AI Toolkit
- CVE-2026-20266 OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit
- CVE-2026-76395 Deserialization in Splunk AI Toolkit
- CVE-2026-76391 Improper Privilege Management through Agent Run History in Splunk AI Toolkit
- CVE-2026-76394 Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit
- CVE-2026-76397 Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit
Sources
Also known as GHSA-qh4m-xcwc-wcgw.