CVE-2026-76393
Race Condition during Model Upload through the REST API in Splunk AI Toolkit
In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The race condition is possible because Splunk AI Toolkit does not verify that the uploaded content belongs to the request that creates the model lookup entry. For more information see Troubleshoot the Splunk Machine Learning Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/machine-learning-toolkit-user-guide/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) in the Splunk documentation.
| CWE | CWE-362 |
| Vendor | splunk |
| Product | splunk ai toolkit |
| Published | Aug 19, 2026 |
Get instant alerts for splunk splunk ai toolkit
Be the first to know when new medium vulnerabilities affecting splunk splunk ai toolkit are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L