CVE-2026-76404
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.
Risk Assessment
A user with administrative privileges can fully compromise the operating system, leading to complete environment compromise.
Recommendation
Update the Splunk MCP Server app to version 1.2.1 or later, which includes the input validation fix.
Other vulnerabilities in Splunk MCP Server
See all- CVE-2026-76286Medium
In Splunk MCP Server versions below 1.2.1, the server could send the Splunk platform authentication token of a user who runs a custom API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it to access data and perform actions as the user who ran the tool. Successful exploitation requires a user with a role containing the mcp_tool_execute capability to run a custom API tool configured by another user.
- CVE-2025-20381Medium
In Splunk MCP Server app versions below 0.2.4, a user with access to the 'run_splunk_query' Model Context Protocol (MCP) tool could bypass the SPL command allowlist controls in MCP by embedding SPL commands as sub-searches, leading to unauthorized actions beyond the intended MCP restrictions.
Original NVD description (English source)
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS