{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ai-toolkit--6.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-76391"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AI Toolkit (\u003c 6.0.0)","AI Toolkit"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["Splunk"],"content_html":"\u003cp\u003eSplunk AI Toolkit versions below 6.0.0 contain a privilege escalation vulnerability (CVE-2026-76391) that allows users without administrative or power user roles to execute searches with system-level privileges. The issue stems from the Agent Run History handler, which incorrectly replaces the user's session key with a system authentication token before initiating search operations. This flaw permits unauthorized users to access restricted data, modify system integrity, and manage search jobs belonging to other users. Defenders should identify instances of the AI Toolkit within their environment and upgrade to version 6.0.0 or higher to remediate the insecure authentication handling.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged user to bypass access controls and perform operations with system-level authorization. This results in unauthorized data exfiltration, the ability to view or delete sensitive search jobs of other users, and potential compromise of system integrity within the Splunk environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Splunk AI Toolkit installations to version 6.0.0 or higher immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for the Agent Run History handler to identify searches initiated by users without appropriate administrative privileges.\u003c/li\u003e\n\u003cli\u003eReview permissions for all users assigned to the AI Toolkit to minimize exposure while the patch is being applied.\u003c/li\u003e\n\u003cli\u003eApply the vendor-recommended security patch documented in the Splunk AI Toolkit release notes for version 6.0.0.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T22:44:54Z","date_published":"2026-08-19T22:44:37Z","id":"https://feed.craftedsignal.io/briefs/2026-08-splunk-ai-toolkit-privesc/","summary":"A privilege escalation vulnerability in Splunk AI Toolkit versions prior to 6.0.0 allows non-privileged users to execute searches with system-level permissions by exploiting an insecure session token replacement mechanism in the Agent Run History handler.","title":"Privilege Escalation in Splunk AI Toolkit via Agent Run History","url":"https://feed.craftedsignal.io/briefs/2026-08-splunk-ai-toolkit-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - AI Toolkit (\u003c 6.0.0)","version":"https://jsonfeed.org/version/1.1"}