Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit

Description

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for connected container services using predictable or hard-coded default values. For more information see Connections tab in the AI Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.7.2/ai-toolkit-commands-macros-and-visualizations/connections-tab-in-the-ai-toolkit) in the Splunk documentation.

Scores

EPSS (exploitation in 30 days)

0.23% · top 86% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• CWE-798: The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. (opens in a new tab)All about CWE-798 and its CVEs

Affected products

• Splunk · Splunk AI Toolkit

  • affected 5.7 – < 6.0.0

What to do

Solution: Upgrade each affected Splunk app or add-on to the applicable fixed version listed in Product Status.

Workaround: Turn off or remove the Splunk AI Toolkit app. For more information see [Manage app and add-on objects](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/meet-splunk-apps/manage-app-and-add-on-objects) in the Splunk documentation. Note: turning off Splunk AI Toolkit turns off AI Toolkit Search Processing Language (SPL) commands and model operations. Splunk App for Data Science and Deep Learning and custom search commands that depend on AI Toolkit models or APIs might stop functioning. Unrelated Splunk custom search commands are not affected. For more information see [Troubleshoot the Splunk Machine Learning Toolkit](https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) and [DSDL install/version dependencies](https://help.splunk.com/en/splunk-enterprise/apply-machine-learning/splunk-app-for-data-science-and-deep-learning/5.1/install-and-configure-the-splunk-app-for-data-science-and-deep-learning/install-or-upgrade-the-splunk-app-for-data-science-and-deep-learning) in the Splunk documentation.

References (1)

• https://advisory.splunk.com/advisories/SVD-2026-0808 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-76392](https://trackcve.app/badge/CVE-2026-76392.svg)](https://trackcve.app/cve/CVE-2026-76392)

Record last updated 26 Aug 2026, 19:35 UTC.