CVE-2026-20238

CVE-2026-20238 describes a vulnerability found in Splunk AI Toolkit versions prior to 5.7.3. This flaw enables a low-privileged user, who does not possess 'admin' or 'power' roles, to access confidential data that should otherwise be restricted through `srchFilter` configurations on custom roles. The issue stems from a logic error in how the Splunk AI Toolkit manages inherited search filters. An `authorize.conf` configuration file within the application contains an `srchFilter` entry that modifies the built-in 'user' role. Due to the Splunk platform's use of the `OR` SPL operator when combining inherited search filters, this injected filter overrides more restrictive `srchFilter` settings applied to child roles, thereby bypassing intended data segmentation controls.