Splunk has disclosed two security vulnerabilities in its AI Toolkit, including a critical-severity OS command injection flaw that could allow admin-level attackers to execute arbitrary commands directly on the underlying host.
Both vulnerabilities affect Splunk AI Toolkit versions below 5.7.4 and were published on June 17, 2026.
The more severe of the two flaws, tracked as CVE-2026-20266 (Advisory ID: SVD-2026-0614), carries a CVSSv3.1 score of 9.1 (Critical) with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Critical Splunk AI Toolkit Flaw
Classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), the flaw resides in the btool configuration helper within the Splunk AI Toolkit.
According to Splunk’s advisory, the vulnerability stems from an unsafe shell-execution pattern in btool that constructs OS command strings from dynamic parameters without disabling shell interpretation.
A user holding the Splunk “admin” role can exploit this to execute arbitrary operating system commands on the host running the Splunk Enterprise instance.
The scope impact is marked as Changed (S:C), indicating that a successful exploit can affect components beyond the vulnerable application itself a hallmark of high-impact server-side command injection vulnerabilities.
Splunk confirmed that no detection mechanisms are currently available for this flaw, underscoring the urgency of immediate patching. The only available workaround is to uninstall the Splunk AI Toolkit entirely if an upgrade cannot be applied immediately.
The second vulnerability, CVE-2026-20265 (Advisory ID: SVD-2026-0613), scores 4.3 (Medium) on the CVSSv3.1 scale with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, classified under CWE-1188 (Insecure Default Initialization of Resource).
This flaw exists because the Splunk AI Toolkit ships with an insecure default domain allowlist that fails to restrict outbound AI agent requests to approved external domains.
A low-privileged user, one without the “admin” or “power” Splunk role, could manipulate the toolkit into making outbound HTTP requests to an attacker-controlled server, enabling data exfiltration.
The absence of enforced domain validation by default makes this vulnerability exploitable with minimal permissions. Administrators who cannot immediately upgrade can mitigate the risk by editing the local/mlspl.conf configuration file.
Under the [ai:AllowedDomains] stanza, explicitly define approved domains in the allowed_domains setting and ensure enforce_domain_validation is set to true. When this flag is false, the toolkit ignores the domain list entirely.
Both vulnerabilities affect Splunk AI Toolkit version 5.7, specifically all builds below 5.7.4. Splunk has released version 5.7.4 as the official fix for both CVEs. Organizations running any earlier build of the 5.7 branch are advised to upgrade immediately.
Mitigation
- Upgrade Splunk AI Toolkit to version 5.7.4 or higher as the primary remediation
- If upgrading is not immediately possible, enforce domain validation via
mlspl.conffor CVE-2026-20265 - For CVE-2026-20266, uninstall the toolkit if patching is delayed, as no other workaround exists
- Monitor outbound HTTP traffic from Splunk Enterprise instances for anomalous external connections
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
