CVE-2026-20238: In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data that was…

PriorityP340medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EPSS

0.32%

23.7th percentile

In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data that was restricted through `srchFilter` configurations on custom roles.The app contains an `authorize.conf` configuration file with a `srchFilter` entry that modifies the built-in ‘user’ role. Because the Splunk platform combines inherited search filters with the `OR` SPL operator, the injected filter overrides more restrictive filters on child roles.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
splunk	ai_toolkit	>= 5.7.0 < 5.7.3	5.7.3
splunk	splunk_ai_toolkit	>= 5.7 < 5.7.3	5.7.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.