CVE-2026-20266: Critical OS Command Injection Hits Splunk AI Toolkit (CVSS 9.1)

TL;DR

Splunk patched a critical OS command injection flaw in its AI Toolkit, tracked as CVE-2026-20266. The bug scores 9.1 and lets an admin-role user run arbitrary commands on the host. Splunk also disclosed four more advisories across Splunk Enterprise and Enterprise Security. No active exploitation has been confirmed.

Why It Matters

Splunk sits at the center of many security operations centers. A flaw in that platform therefore puts detection and response data at risk. The Splunk AI Toolkit OS command injection is the most severe of the batch, rated critical at 9.1.

Attackers who reach an admin account could run host commands and pivot deeper. Because Splunk often holds credentials and logs, the blast radius grows fast. Gabriel Nitu of Splunk found and reported the issue.

How the Attack Works

The flaw lives in the btool configuration helper inside the AI Toolkit. That helper builds OS command strings from dynamic parameters. It does not disable shell interpretation, so crafted input reaches the shell.

As a result, a user with the Splunk “admin” role can execute arbitrary commands. The CVSS vector marks scope as Changed, meaning impact spreads beyond the app itself. Splunk classifies the Splunk AI Toolkit OS command injection under CWE-78. Details on the primary bug appear in the official Splunk advisory SVD-2026-0614.

The Four Companion Advisories

Splunk shipped four related fixes on July 15 and August 19. Each needs different privileges, but all deserve attention.

CVE-2026-20296 is a CSRF flaw in the Deployment Server, scoring 8.3. It can trick a capable user into running SPL as the system user. Splunk documents it in advisory SVD-2026-0702.

CVE-2026-20297 is a path traversal bug during app installation, rated 7.2. It lets a privileged role write files outside the app directory, as noted in advisory SVD-2026-0703. CVE-2026-20298 exposes stored credential hashes through the storage/passwords endpoint at 5.3 severity. See advisory SVD-2026-0704 for details.

Finally, the Enterprise Security hardening release SVD-2026-0807 fixes SPL injection and privilege escalation, each scoring 8.1.

Affected Versions

The critical bug affects Splunk AI Toolkit versions below 5.7.4. The Enterprise flaws hit releases below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, among others. Enterprise Security below 8.6.1 is also affected. Splunk does not publish install counts, so exposure estimates remain unavailable.

Patch and Mitigation Steps

Upgrade the Splunk AI Toolkit to 5.7.4 or higher right away. If patching must wait, uninstall the toolkit as a stopgap. No other workaround exists for the command injection flaw.

For Splunk Enterprise, move to the listed fixed releases. Splunk is patching Cloud Platform instances directly. Restrict admin access, apply least privilege, and watch for unusual command activity.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.