CVE-2026-76394 — CVSS 8.3 HIGH Severity | NVD Vulnerability Record

Executive Summary

Splunk AI Toolkit versions < 6.0.0 expose a missing authorization flaw that lets any low‑privileged user start, stop, and re‑configure containers via the REST API. The vulnerability (CVE‑2026‑76394) carries a CVSS 8.3 score, indicating high potential for data loss, service disruption, and lateral movement across environments that rely on Splunk AI services. Immediate decisions are required on patch deployment, temporary API hardening, and incident‑response activation to prevent unauthorized container manipulation.

Verified Facts

• The vulnerability exists in Splunk AI Toolkit versions below 6.0.0 — NVD.
• Low‑privileged users without “admin” or “power” roles can start, stop, configure containers, and modify connection data via the REST API — NVD.
• The flaw is caused by multiple REST API handlers that do not enforce authorization checks (CWE‑862) — NVD.

Threat Classification

Privilege‑escalation vulnerability (exploitation for privilege escalation) affecting any organization deploying Splunk AI Toolkit globally; exploitation is currently theoretical with no public exploit disclosed (MEDIUM CONFIDENCE). Motivation is opportunistic data access and service disruption (MEDIUM CONFIDENCE).

Threat Severity Assessment

• Exploitability: Network‑remote, low authentication required (HIGH CONFIDENCE).
• Impact Scope: Ability to control containers and modify configuration data (HIGH CONFIDENCE).
• CVSS Score: 8.3 (HIGH CONFIDENCE).
• Prevalence: All deployments of Splunk AI Toolkit < 6.0.0 are vulnerable (MEDIUM CONFIDENCE).

Business Impact

Unauthorized container control can terminate critical ML workloads, inject malicious models, and expose sensitive data, leading to operational downtime estimated at $150k‑$500k per incident for large enterprises. Under GDPR or NIS2, exposure of personal data processed by AI models may trigger fines up to €20 million or 4 % of global turnover. SOC 2 compliance could be breached due to inadequate access controls, requiring costly remediation audits. Reputational damage includes loss of customer trust in AI‑driven services and potential market share erosion.

Technical Analysis

Attack Vector: Network‑based REST API call (AV:N). Exploitation Chain: Low‑privileged user authenticates to Splunk UI → Sends HTTP request to vulnerable container‑management endpoint → No authorization check → Container start/stop or configuration change executed. Affected Component: Splunk AI Toolkit REST API handlers. Root Cause: Missing authorization enforcement (CWE‑862). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H. Affected Versions: < 6.0.0.

CVE Analysis

• CVE‑2026‑76394 — Splunk AI Toolkit < 6.0.0 — CWE‑862 (Missing Authorization) — Network (AV:N) — Authentication required: Low (PR:L) — Patch available in version 6.0.0.

MITRE ATT&CK Mapping

• Privilege Escalation → T1068: Exploitation for Privilege Escalation — low‑privileged user leverages missing auth to perform admin‑level container actions.
• Impact → T1609: Container Administration Command — attacker can start, stop, and re‑configure containers via the REST API.

IOC Intelligence

No public IOCs confirmed at time of publication.

Defenders should build hunt rules around the following behavioral indicators:

• REST API calls to “/services/.../containers” endpoints originating from users lacking “admin” or “power” roles.
• HTTP POST/PUT/DELETE methods that result in container lifecycle changes (start/stop/reconfigure).
• Configuration file modifications performed via API calls by non‑privileged accounts.
• Unusual outbound traffic from the Splunk AI Toolkit host immediately after container start events.

Detection Engineering Guidance

• Collect Splunkd access logs (splunkd.log) and REST API audit logs; filter on URI containing “/containers” and HTTP methods POST, PUT, DELETE.
• Correlate with user role attributes from LDAP/SSO to flag requests where role ≠ admin/power.
• Monitor process creation events (Windows Sysmon Event ID 1, Linux auditd) for container runtime binaries (docker, containerd) launched by Splunk processes.
• Alert on configuration change API responses with HTTP 200 but originating from low‑privilege accounts.
• Enrich alerts with asset inventory to identify critical AI workloads attached to the affected containers.

Sigma Rules

title: Splunk REST API Container Management by Low‑Privileged User
id: c5d2e1b0-9f4a-4c3e-8a2b-1d2e3f4a5b6c
status: stable
description: Detects REST API calls that manage containers when executed by users without admin or power roles.
logsource:
    product: splunk
    service: splunkd
detection:
    selection:
        event_type: rest_api
        uri|contains: "/containers"
        method|contains: ["POST", "PUT", "DELETE"]
        user_role|not_contains: ["admin", "power"]
    condition: selection
falsepositives:
    - Legitimate automation scripts run by service accounts with proper roles
tags:
    - attack.t1068
    - attack.t1609
level: high

Threat Hunting Queries

• Hypothesis: Low‑privileged users are invoking container start/stop APIs — Source: Splunkd access logs; Query: `index=_internal sourcetype=splunkd_access uri="*/containers*" (method=POST OR method=PUT OR method=DELETE) NOT (user_role=admin OR user_role=power)`
• Hypothesis: Configuration files are being altered via API by non‑admin accounts — Source: Splunk audit logs; Query: `index=_audit action=modify_config NOT (user_role=admin OR user_role=power)`
• Hypothesis: Unexpected container runtime processes spawned by Splunk — Source: Sysmon (Windows) or auditd (Linux); Query: `EventID=1 Image=*docker* OR Image=*containerd* ParentImage=*splunkd*`
• Hypothesis: Outbound connections from Splunk AI Toolkit host after container start — Source: Network flow logs; Query: `src_ip=SplunkAIHost dest_port!=443 dest_ip!=internal_network`
• Hypothesis: Role escalation attempts via REST API error responses — Source: Splunkd logs; Query: `uri="*/auth*" status=403 user_role!=admin`

SOC Analyst Playbook

• P0 – Immediate (0‑1 hr): Pull splunkd_access logs for the last 24 h; filter for “/containers” URIs by non‑admin users; generate alert if any match.
• P0 – Immediate (0‑1 hr): Disable the vulnerable REST API endpoints via Splunk UI or web.conf until patch is applied

🔗 Related Intelligence Reports

• Related topic: CVE-2026-76395 — CVSS 8.8 HIGH Severity | NVD Vulnerability Record
• Related topic: CISA KEV Alert: CVE-2026-73570 — Zimbra Collaboration Suite (ZCS) OS Command Injection Vul
• Related topic: CISA KEV Alert: CVE-2026-69836 — Microsoft Entra ID Deserialization of Untrusted Data Vuln
• Related topic: CVE-2026-76225 — CVSS 7.7 HIGH Severity | NVD Vulnerability Record
• Related topic: CVE-2026-67567 — CVSS 9.9 CRITICAL Severity | NVD Vulnerability Record