Executive brief
The Splunk AI Toolkit, an extension used for machine learning and AI operations, contains a security flaw that allows users with limited permissions to bypass network restrictions. An attacker could exploit this to force the toolkit to send data to an external server they control, potentially leading to the theft of sensitive information. Organizations should update to version 5.7.4 or manually configure domain restrictions to prevent unauthorized data transfers.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Splunk AI Toolkit due to an insecure default domain allowlist (CWE-1188). The toolkit's AI agent requests do not properly restrict outbound HTTP connections to approved external domains by default. A remote attacker with low-privileged access (non-admin/power roles) can trigger outbound requests to an arbitrary attacker-controlled server. This can be used to exfiltrate data from the Splunk environment. The issue is resolved in version 5.7.4, or can be mitigated by explicitly defining allowed domains in the mlspl.conf configuration file.
Affected products
- Splunk AI Toolkit < 5.7.4
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched