CVE-2026-76395: In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the

Splunk AI Toolkit versions before 6.0.0 have a vulnerability where users with the "power" role can run arbitrary code (commands the attacker chooses) on the Splunk server by uploading a specially crafted model file. The problem occurs because the toolkit deserializes (converts stored data back into usable form) untrusted data without checking for hidden malicious code in pickle format (Python's method for storing objects).