This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Splunk AI Toolkit fixes 2 vulnerabilities
Splunk fixes 2 vulnerabilities in Splunk AI Toolkit with version 5.7.4 [1].
An authenticated remote attacker with administrator privileges can execute arbitrary operating system commands due to unsafe parameter handling in the btool utility [1].
The vulnerability is present in product:
- Splunk AI Toolkit; >=5.7, <5.7.4
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-20266 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 17. 6. 2026.
An authenticated remote attacker with low privileges can carry out an SSRF attack and obtain sensitive information due to insufficient restriction of outgoing requests [2].
The vulnerability is present in product:
- Splunk AI Toolkit; >=5.7, <5.7.4
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2026-20265 at cve.org, NVD
- CWE-1188: Initialization of a Resource with an Insecure Default at cwe.mitre.org
The vulnerability was publicly disclosed 17. 6. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 18. 6. 2026.