CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged

title: Splunk AI Toolkit Unauthorized Data Access via srchFilter Override — CVE-2026-20238
id: scw-2026-05-20-ai-1
status: experimental
level: high
description: |
  Detects attempts to access confidential data by exploiting a vulnerability in Splunk AI Toolkit versions below 5.7.3. A low-privileged user can override `srchFilter` configurations on custom roles, allowing access to restricted data. This rule specifically looks for web requests targeting Splunk's search job export endpoint, which could be used to exfiltrate data after the filter override.
author: SCW Feed Engine (AI-generated)
date: 2026-05-20
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-20238/
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/en-US/splunkd/run'
      cs-uri-query|contains:
          - 'search/jobs/export'
      sc-status:
          - 200
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse