Medium severity · published Aug 19, 2026
CVE-2026-76392
Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for connected container services using predictable or hard-coded default values. For more information see Connections tab in the AI Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.7.2/ai-toolkit-commands-macros-and-visualizations/connections-tab-in-the-ai-toolkit) in the Splunk documentation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Splunk AI Toolkit · Splunk
5.7 before 6.0.0 · source: vendor
AT
AI Toolkit · Splunk
5.7.0 before 6.0.0 · source: NVD
Affected product
SA
Splunk AI Toolkit
Splunk
More from Splunk AI Toolkit
9.1
CVE-2026-20266
OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit
8.8
CVE-2026-76395
Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit
8.3
CVE-2026-76394
Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit
8.3
CVE-2026-76391
Improper Privilege Management through Agent Run History in Splunk AI Toolkit
8.1
CVE-2026-76399
Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit