# CVE-2026-76394: Splunk AI Toolkit missing authorization in REST API container management

Source: https://junglewise.ai/threats/cve-2026-76394-splunk-ai-toolkit-missing-authorization-in-rest-api-container  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76394 · Severity: high · CVSS 8.3 · Published 2026-08-19

Splunk AI Toolkit is a machine learning platform integrated with Splunk data analytics. A low-privileged user without admin or power roles could start, stop, and configure containers, and read or modify connection configuration data through unauthorized REST API access. An attacker with basic user credentials could manipulate critical ML infrastructure and access sensitive data, potentially compromising model integrity and operational security.

Technologies: [Splunk AI Toolkit](https://junglewise.ai/threats/technologies/ai-toolkit). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-76394 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76394 being exploited in the wild.

**How severe is CVE-2026-76394?** High severity, with a CVSS score of 8.3, published 19 August 2026.

**Which products and versions are affected?** Splunk AI Toolkit below 6.0.0 (5.7 branch); below 6.0.1 (6.0 branch).

**Is there a fix for CVE-2026-76394?** A patch was published on 2026-08-19: Fixed in version 6.0.0 (5.7 branch) and 6.0.1 (6.0 branch) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76394 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76394?** Check whether you run Splunk AI Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a missing authorization vulnerability (CWE-862) in Splunk AI Toolkit versions below 6.0.0. Multiple REST API handlers for container and connection management fail to enforce proper authorization checks, allowing low-privileged users to perform privileged operations. The attack vector is network-based and requires only standard user credentials (no admin/power role); no user interaction or additional authentication is needed beyond basic Splunk login. An attacker can start/stop containers, modify configuration data, and access connection credentials. The vulnerability was fixed in version 6.0.0 (for 5.7 branch) and 6.0.1 (for 6.0 branch).

## Affected products

- Splunk AI Toolkit below 6.0.0 (5.7 branch); below 6.0.1 (6.0 branch)

## Timeline

- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in version 6.0.0 (5.7 branch) and 6.0.1 (6.0 branch)

## References

- [https://advisory.splunk.com/advisories/SVD-2026-0808](https://advisory.splunk.com/advisories/SVD-2026-0808)

## Related threats

- [Splunk AI Toolkit incorrect permission assignment for scheduled searches](https://junglewise.ai/threats/cve-2026-76399-splunk-ai-toolkit-incorrect-permission-assignment-for-scheduled)
- [Splunk AI Toolkit improper access control in experiment history deletion](https://junglewise.ai/threats/cve-2026-76398-splunk-ai-toolkit-improper-access-control-in-experiment-history)
- [Splunk AI Toolkit improper access control in experiment history](https://junglewise.ai/threats/cve-2026-76397-splunk-ai-toolkit-improper-access-control-in-experiment-history)
- [Splunk AI Toolkit improper access control in scheduled searches](https://junglewise.ai/threats/cve-2026-76396-splunk-ai-toolkit-improper-access-control-in-scheduled-searches)
- [Splunk AI Toolkit RCE through unsafe model deserialization](https://junglewise.ai/threats/cve-2026-76395-splunk-ai-toolkit-rce-through-unsafe-model-deserialization)