What’s Vulnerable › Vulnerabilities
CVE-2026-76392: Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-19 · updated 2026-08-26
- Weakness: CWE-798
Description
In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for connected container services using predictable or hard-coded default values. For more information see Connections tab in the AI Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.7.2/ai-toolkit-commands-macros-and-visualizations/connections-tab-in-the-ai-toolkit) in the Splunk documentation.
Affected products
- Splunk AI Toolkit: from 5.7.0 before 6.0.0 — fixed in 6.0.0
How to fix
Upgrade to a fixed version: Splunk AI Toolkit 6.0.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-76392 or the next vulnerability affects your stack