Quick answers
- Is CVE-2026-20238 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20238 being exploited in the wild.
- How severe is CVE-2026-20238?
- Medium severity, with a CVSS score of 6.5, published 20 May 2026.
- Which products and versions are affected?
- Splunk AI Toolkit < 5.7.3.
- Is there a fix for CVE-2026-20238?
- A patch was published on 2026-05-20: Fixed in version 5.7.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-20238 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-20238?
- Check whether you run Splunk AI Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Splunk AI Toolkit contains an 'authorize.conf' configuration file that incorrectly modifies the built-in 'user' role with a 'srchFilter' entry. Because the Splunk platform processes inherited search filters using the 'OR' SPL operator, this injected filter effectively overrides more restrictive filters defined on child or custom roles. An authenticated attacker with low privileges can exploit this logic to view data that should be restricted by their specific role's search filters. The vulnerability is resolved in version 5.7.3, and workarounds include manually removing the srchFilter line from the configuration file.
Affected products
- Splunk AI Toolkit < 5.7.3
Timeline
- 2026-05-20: disclosed
- 2026-05-20: advisory
- 2026-05-20: patched: Fixed in version 5.7.3