Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Splunk/Splunk AI Toolkit (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Splunk/Splunk AI Toolkit.
2. 2Review the reported fix. Update Splunk/Splunk AI Toolkit to 6.0.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 19, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 19, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 19, 2026

Sources and claim methodology

• Source referenceadvisory.splunk.com

Related CVEs

• Improper Privilege Management through Agent Run History in Splunk AI ToolkitSame splunk/splunk ai toolkit package
• Use of Hard-coded Credentials in Container Connections in Splunk AI ToolkitSame splunk/splunk ai toolkit package
• Race Condition during Model Upload through the REST API in Splunk AI ToolkitSame splunk/splunk ai toolkit package
• Missing Authorization in Container and Connection Management through the REST API in Splunk AI ToolkitSame splunk/splunk ai toolkit package
• Improper Access Control through Scheduled Searches in Splunk AI ToolkitSame splunk/splunk ai toolkit package
• Improper Access Control in Experiment History through the REST API in Splunk AI ToolkitSame splunk/splunk ai toolkit package