The flaw lies in the deserialization logic of the Splunk AI Toolkit’s model loading REST API. A crafted model file that contains malicious pickle data can be supplied by a user who holds the Splunk ‘power’ role, causing the server to execute arbitrary code during deserialization of sparse matrix data. The result is a full remote code execution opportunity for an authenticated authority level on the Splunk instance.

Splunk AI Toolkit versions lower than 6.0.0 are affected. Any Splunk deployment that includes an older AI Toolkit app and assigns the ‘power’ role to a user can be targeted, regardless of the overall Splunk Enterprise or Cloud version.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. Although an EPSS score is not currently provided, the lack of a known KEV listing does not diminish the risk, as the attack requires only that an authorized user upload a malicious model file—an action possible through the exposed REST interface. The combination of privileged role, insecure deserialization, and lack of input validation means that exploitation is straightforward should an attacker gain the necessary permissions.