CVE-2026-20266
OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit
Severity
Critical 9.1
CVSS 3.1
Exploited
Not listed
EPSS
0.006
49.0th percentile
Discovered by
Not disclosed
Published
Jun 17, 2026
Assigned by cisco
Description
In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Splunk Apps & Add-ons | SIEM & Log Management | cna-assigner |
Vendor-reported products (1)
- Splunk · Splunk AI Toolkit
Credit
Gabriel Nitu, Splunk