Splunk Advisory: Multiple Vulnerabilities in Add-ons (SSRF, Priv Esc, Info Disclosure) CVE-2026-76389-76392

The following is a summary of key vulnerability information regarding the web page screenshot: Vulnerability Overview Multiple vulnerabilities have been identified in several Splunk apps and add-ons, including: Cisco Talos Intelligence for Enterprise Security Cloud Splunk AI Toolkit Splunk Connect for Kafka Splunk MCP Server app Splunk On-Call (VictorOps) Affected Scope Cisco Talos Intelligence for Enterprise Security Cloud: Versions below 1.0.3 Splunk AI Toolkit: Versions below 6.0.1 and 6.0.0 Splunk Connect for Kafka: Versions below 2.2.7 Splunk MCP Server app: Versions below 1.2.1 Splunk On-Call (VictorOps): Versions below 1.0.43 Remediation Upgrade each affected Splunk app or add-on to the applicable patched version. Vulnerability Details CVE-2026-76389: Server-Side Request Forgery (SSRF) via Cisco Talos Intelligence for Enterprise Security Cloud REST API Description: In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, users with the capability can send malicious requests to the Talos Intelligence enrichment REST API endpoint, causing the instance to make outbound requests to a server controlled by an attacker. CVE ID: CVE-2026-76389 CWE: CWE-918 CVSSv3.1 Score: 8.8, High CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Mitigations and Workarounds: Disable or remove the Cisco Talos Intelligence for Enterprise Security Cloud app. CVE-2026-76390: Information Disclosure via Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud Description: In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, unauthenticated users can access the add-on's OpenAPI specification via the Splunk Web static file path. CVE ID: CVE-2026-76390 CWE: CWE-200 CVSSv3.1 Score: 5.3, Medium CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Mitigations and Workarounds: Disable or remove the Cisco Talos Intelligence for Enterprise Security Cloud app. CVE-2026-76391: Improper Privilege Management via Agent Run History in Splunk AI Toolkit Description: In Splunk AI Toolkit versions below 6.0.0, users without the "admin" or "power" Splunk role can run searches with system-level permissions, accessing all relevant data. This impacts system integrity and allows reading or deleting other users' search jobs. CVE ID: CVE-2026-76391 CWE: CWE-863 CVSSv3.1 Score: 8.3, High CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Mitigations and Workarounds: Disable or remove the Splunk AI Toolkit app. CVE-2026-76392: Use of Hardcoded Credentials in Container Connections in Splunk AI Toolkit Description: In Splunk AI Toolkit versions below 6.0.0, users without the "admin" or "power" Splunk role can obtain predictable or default credentials for container services. CVE ID: CVE-2026-76392 CWE: CWE-798 CVSSv3.1 Score: 5.4, Medium CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:A:N Mitigations and Workarounds: Disable or remove the Splunk AI Toolkit app. CVE-2026-76393: Race Condition During Model Upload via REST API in Splunk AI Toolkit Description: In Splunk AI Toolkit versions below 6.0.0, users who can upload models can overwrite another user's model by sending concurrent upload requests. CVE ID: CVE-2026-76393 CWE: CWE-362 CVSSv3.1 Score: 5.9, Medium CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L Mitigations and Workarounds: Disable or remove the Splunk AI Toolkit app. CVE-2026-76394: Missing Authorization in Container and Connection Management via REST API in Splunk AI Toolkit Description: In Splunk AI Toolkit versions below 6.0.0, low-privileged users (those without the "admin" or "power" Splunk role) can start, stop, and configure containers, as well as read or modify connection and configuration data. CVE ID: CVE-2026-76394 CWE: CWE-862 CVSSv3.1 Score: 8.3, High CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Mitigations and Workarounds: Disable or remove the Splunk AI Toolkit app. CVE-2026-76395: Remote Code Execution (RCE) via Untrusted Data Deserialization of Model Loading REST API in Splunk AI Toolkit Description: In Splunk AI Toolkit versions below 6.0.0, users with the "power" Splunk role can execute arbitrary code on the Splunk server by loading model files containing malicious sparse matrix data. CVE ID: CVE-2026-76395 CWE: CWE-502 CVSSv3.1 Score: 8.8, High CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Mitigations and Workarounds: Disable or remove the Splunk AI Toolkit app. CVE-2026-76396: Improper Access Control via Scheduled Searches in Splunk AI Toolkit Description: In Splunk AI Toolkit versions below 6.0.0, users with the capability may cause scheduled searches to load and deserialize model files. CVE ID: CVE-2026-76396 CWE: CWE-200 CVSSv3.1 Score: 5.3, Medium CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Mitigations and Workarounds: Disable or remove the Splunk AI Toolkit app. Other Vulnerabilities CVE-2026-76404: Denial of Service (DoS) via REST API in Splunk Connect f

Goal Reached Thanks to every supporter — we hit 100%!

Splunk Advisory: Multiple Vulnerabilities in Add-ons (SSRF, Priv Esc, Info Disclosure) CVE-2026-76389-76392