Splunk AI Toolkit Agent Run History Privilege Escalation

Technical Analysis

The vulnerability lies in the Agent Run History handler within the AI Toolkit's Agent Launchpad, which manages records of past agent-driven search executions. When a non-admin, non-power user invokes this handler, it internally substitutes their session key with a system-level authentication token before performing the underlying Splunk search operation, effectively granting system privileges for that request. This breaks the intended privilege boundary between regular users and admin/power users, allowing unauthorized access to all indexed data and the ability to view or delete search jobs belonging to other users. The entry point is any API or UI interaction with Agent Run History; no agent-to-agent or model-level manipulation is required, and exploitation is a single-hop privilege escalation within the Splunk platform rather than a cross-agent or prompt-based attack.

Affected Systems

Splunk AI Toolkit (versions below 6.0.0)

Detection Signatures

• Splunk internal logs showing search jobs executed under system authentication tokens initiated by non-admin/non-power user accounts
• Agent Run History access events correlated with unexpected system-level search scope
• Unauthorized deletion or viewing of search jobs owned by other users via Agent Launchpad endpoints
• Anomalous privilege level in _internal or audit index logs tied to AI Toolkit agent handlers

Remediation Steps

1. 1

   Upgrade AI Toolkit

   Update Splunk AI Toolkit to version 6.0.0 or later, which fixes the improper privilege management in the Agent Run History handler.

2. 2

   Restrict role assignments

   Audit which users have access to Agent Launchpad and Agent Run History features and limit access to admin/power roles until patched.

3. 3

   Review search job logs

   Audit historical search job execution and deletion logs for signs that non-privileged users accessed system-level search results or tampered with other users' jobs.

4. 4

   Apply least privilege to session token handling

   Ensure any custom or third-party AI Toolkit extensions do not similarly substitute elevated tokens for user session keys without explicit authorization checks.