Insecure Default Domain Allowlist in Splunk AI Toolkit (Splunk Splunk AI Toolkit)
En bref
- Source
- NVD
- EPSS
- EPSS 0.22 % · centile 12 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- cisco
- Statut NVD
- Analyzed
Description
In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exfiltration. The vulnerability exists because of an insecure default domain allowlist in the Splunk AI Toolkit, which does not restrict outbound AI agent requests to approved external domains.
Faiblesses (CWE)
- CWE-1188 — Initialisation par défaut non sécurisée d'une ressource
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | cisco |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · psirt@cisco.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-37767
- GCVE · GCVE-0-2026-20265
Avis du CERT-FR
- CERTFR-2026-AVI-0774 — Multiples vulnérabilités dans Splunk AI Toolkit · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:splunk:ai_toolkit:*:*:*:*:*:*:*:*≥ 5.7.0 < 5.7.4
Produits affectés
| Produit | Versions |
|---|---|
| Splunk · Splunk AI Toolkit | affected 5.7 < 5.7.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |