CVE-2026-76397 Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit

High 8.1 Published 19 Aug 2026 Updated 20 Aug 2026

A user with the power role can access and delete other users' experiment history data due to improper access control in the REST API.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-76397?

CVE-2026-76397 is a high-severity missing authorization vulnerability in Splunk AI Toolkit, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope when it processes caller-controlled query values before accessing restricted history data. For more information see Experiment Assistants (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.6.4/experiment-assistants) in the Splunk documentation.

Weakness: CWE-639

Which versions are affected by CVE-2026-76397?

It affects 1 product.

Products include Splunk Ai Toolkit.

How do I fix CVE-2026-76397?

No fix has been published for CVE-2026-76397 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-76397 being exploited?

There is no known exploitation of CVE-2026-76397 in the wild and no public exploit code.

Sources

Also known as GHSA-q3cf-x2fg-gv4f.