1. Home
  2. CVE Database
  3. CVE-2026-20266
CRITICAL · 9.1

CVE-2026-20266

In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is poss...

Vulnerability Description

In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
SplunkAi Toolkit>= 5.7.0, < 5.7.4

Related Weaknesses (CWE)

CWE-78

References

FAQ

What is CVE-2026-20266?

CVE-2026-20266 is a vulnerability with a CVSS score of 9.1 (CRITICAL). In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is poss...

How severe is CVE-2026-20266?

CVE-2026-20266 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-20266?

Check the references section above for vendor advisories and patch information. Affected products include: Splunk Ai Toolkit.