In Splunk AI Toolkit versions earlier than 5.7.4, an insecure default domain allowlist permits outbound HTTP requests to any external server. A low‑privileged user with no "admin" or "power" role can trigger the AI agent to contact an attacker‑controlled host, enabling data exfiltration in the context of the Splunk instance. The flaw is classified as CWE-1188, an improper restriction of network resources.

Splunk AI Toolkit 5.7.3 and earlier are vulnerable. The issue does not affect 5.7.4 or later releases where the allowlist restriction is implemented.

The CVSS score of 4.3 indicates a moderate risk, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. A likely attack vector is a local user with limited permissions executing a command that forces the toolkit to perform an outbound HTTP request; inference implies that an attacker must already have local access to the Splunk system or exploit a related privilege‑escalation flaw to widen the reach.