CVE-2026-76398 Improper Access Control during Experiment History Deletion through the REST API in Splunk AI Toolkit

Medium 4.3 Published 19 Aug 2026 Updated 20 Aug 2026

Unprivileged users can delete other users' experiment history via the REST API due to improper access control checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-76398?

CVE-2026-76398 is a medium-severity missing authorization vulnerability in Splunk AI Toolkit, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk AI Toolkit deletes experiment history before it verifies that the user can delete the associated experiment. For more information see Experiment Assistants (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.6.4/experiment-assistants) in the Splunk documentation.

Weakness: CWE-862

Which versions are affected by CVE-2026-76398?

It affects 1 product.

Products include Splunk Ai Toolkit.

How do I fix CVE-2026-76398?

No fix has been published for CVE-2026-76398 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-76398 being exploited?

There is no known exploitation of CVE-2026-76398 in the wild and no public exploit code.

Sources

Also known as GHSA-cq72-pxmj-w4mh.