CVE-2026-20265: falha de média gravidade em Splunk AI Toolkit
Insecure Default Domain Allowlist in Splunk AI Toolkit
Publicada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.2%
probabilidade de exploração
0.2%top 89% das CVEs
exploração observada
nãonenhuma fonte reporta
In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exfiltration.
The vulnerability exists because of an insecure default domain allowlist in the Splunk AI Toolkit, which does not restrict outbound AI agent requests to approved external domains.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Splunk · Splunk AI ToolkitCVEs relacionadas — Splunk AI Toolkit
No mesmo produto, das mais perigosas para as menos.
CVE-2026-76395HIGHRemote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI ToolkitEPSS 0.7%CVE-2026-20266CRITICALOS Command Injection in the btool Configuration Helper in Splunk AI ToolkitEPSS 0.6%CVE-2026-76391HIGHImproper Privilege Management through Agent Run History in Splunk AI ToolkitEPSS 0.5%CVE-2026-76399HIGHIncorrect Permission Assignment for Scheduled Searches in Splunk AI ToolkitEPSS 0.4%CVE-2026-76397HIGHImproper Access Control in Experiment History through the REST API in Splunk AI ToolkitEPSS 0.4%CVE-2026-76394HIGHMissing Authorization in Container and Connection Management through the REST API in Splunk AI ToolkitEPSS 0.4%