by Kastro
Paper/Archive/CVE-2026-20266

CVE-2026-20266

Splunk Splunk AI Toolkit — OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 50.3.503 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.

Affected

ProductAffectedFixed inSource
Splunk AI Toolkit5.7 – < 5.7.45.7.4CNA

Scores by source

cisco (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refadvisory.splunk.com/advisories/SVD-2026-0614