CVE-2026-76395

Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0

Description A user with the "power" Splunk role can execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. This occurs because a model codec deserializes sparse matrix data without guarding against embedded pickle content, allowing for the deserialization of untrusted data. Deserialization is the process of converting a data format (like a file or byte stream) back into an object that the application can use.

Recommendations Update Splunk AI Toolkit to version 6.0.0 or later.