Splunk AI Toolkit Hit by Critical 9.1 CVE: Admins Can Run Arbitrary OS Commands, No Detection Available

Splunk has disclosed two security vulnerabilities affecting its AI Toolkit, the most serious of which carries a near maximum severity score and could allow an authenticated administrator to run arbitrary operating system commands on the underlying host. Both flaws affect every build of Splunk AI Toolkit prior to version 5.7.4 and were published on 17 June 2026.

The more severe issue, tracked as CVE-2026-20266 (Advisory SVD-2026-0614), carries a CVSS v3.1 score of 9.1, placing it firmly in the critical band. The vulnerability sits within the toolkit's btool configuration helper, which constructs operating system command strings from dynamic parameters without properly disabling shell interpretation, a classic OS command injection pattern (CWE-78). A user holding Splunk's "admin" role can exploit the flaw to execute commands directly on the host running the Splunk Enterprise instance, with the scope of impact marked as "changed", meaning the damage can extend well beyond the Splunk application itself into the wider host environment.

Splunk has confirmed that no detection mechanism currently exists for this flaw, which raises the urgency considerably. For organisations that cannot apply the fix immediately, the only documented workaround is to uninstall the AI Toolkit entirely.

A Second, Lower Severity Flaw

The second disclosed issue, CVE-2026-20265 (Advisory SVD-2026-0613), is rated medium severity at 4.3. It stems from an insecure default domain allowlist that fails to restrict outbound requests made by AI agents within the toolkit. In practice, this means a low privileged user, someone without admin or power level Splunk access, could manipulate the toolkit into sending outbound HTTP requests to a server under an attacker's control, opening a path for data exfiltration. Because the toolkit ships with domain validation effectively unenforced by default, this is exploitable with minimal privileges.

Administrators unable to patch immediately can mitigate CVE-2026-20265 by editing the local mlspl.conf file: define approved destinations under the [ai:AllowedDomains] stanza and set enforce_domain_validation to true. Leaving that flag false causes Splunk to ignore the allowlist entirely, regardless of what domains are listed.

Why This Matters for GCC Security Teams

Splunk remains one of the most widely deployed SIEM platforms across GCC enterprise and government environments, often sitting at the centre of an organisation's detection and response capability. A flaw that allows command execution on the host running that platform is a direct threat to the integrity of the very system meant to detect intrusions elsewhere in the network. Teams that have recently evaluated or deployed SIEM platforms as part of broader compliance programmes should treat this disclosure as a priority patching item rather than routine maintenance.

This also lands amid a broader pattern this week of enterprise security platforms drawing critical disclosures in quick succession, following Fortinet's mass credential theft exposure and continued active exploitation against Palo Alto's PAN-OS firewalls. Perimeter and platform vendors alike are facing sustained scrutiny in 2026, and the message for enterprise security teams is consistent: patching cadence on core infrastructure can no longer be treated as a quarterly task.

Mitigation Steps

1. Upgrade Splunk AI Toolkit to version 5.7.4 or later. This is the primary and only complete remediation for CVE-2026-20266.
2. If immediate patching isn't possible, uninstall the AI Toolkit, since no other workaround exists for the critical flaw.
3. For CVE-2026-20265, enforce domain validation via mlspl.conf as described above.
4. Monitor outbound HTTP traffic from Splunk Enterprise instances for connections to unfamiliar external destinations.
5. Review admin role assignments within Splunk to ensure the principle of least privilege is genuinely being enforced, not just nominally configured.

Both vulnerabilities affect only the 5.7 branch of the AI Toolkit; organisations should confirm their installed version and prioritise the upgrade path accordingly.