PT-2026-42211 · Splunk · Splunk Ai Toolkit+1

Martin Muller · CVE-2026-20238 · Published 2026-05-20 · Updated 2026-05-26

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data that was restricted through srchFilter configurations on custom roles.

The app contains an authorize.conf configuration file with a srchFilter entry that modifies the built-in ‘user’ role. Because the Splunk platform combines inherited search filters with the OR SPL operator, the injected filter overrides more restrictive filters on child roles.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-20238

Affected Products

Splunk Ai Toolkit

Ai Toolkit

References · 5

• https://advisory.splunk.com/advisories/SVD-2026-0502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20238 · Security Note
• https://twitter.com/CCBalert/status/2059278641356284358 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1to2dti/top_10_trending_cves_26052026 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1tn4o94/top_10_trending_cves_25052026 · Reddit Post