CVE-2026-76404

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2026-0808	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:splunk:model_context_protocol_server:*:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En las versiones de la aplicación Splunk MCP Server anteriores a la 1.2.1, un usuario con el rol de Splunk ’admin’ podría ejecutar comandos arbitrarios en el sistema operativo subyacente. La vulnerabilidad es posible debido a la falta de validación de entrada en el componente de gestión de credenciales de la aplicación, que deserializa datos almacenados sin comprobar si el contenido es del tipo esperado.

Information

Published : 2026-08-19 22:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-76404

Mitre link : CVE-2026-76404

CVE.ORG link : CVE-2026-76404

JSON object : View

Products Affected

splunk

model_context_protocol_server

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-76404", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76404", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T15:09:45.301346Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "product": "Splunk MCP Server app", "versions": [{"status": "affected", "version": "1.2", "lessThan": "1.2.1", "versionType": "custom"}]}]}], "published": "2026-08-19T22:17:27.170", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0808", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "In Splunk MCP Server app versions below 1.2.1, a user who holds the \"admin\" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type."}, {"lang": "es", "value": "En las versiones de la aplicaci\u00f3n Splunk MCP Server anteriores a la 1.2.1, un usuario con el rol de Splunk \u2019admin\u2019 podr\u00eda ejecutar comandos arbitrarios en el sistema operativo subyacente. La vulnerabilidad es posible debido a la falta de validaci\u00f3n de entrada en el componente de gesti\u00f3n de credenciales de la aplicaci\u00f3n, que deserializa datos almacenados sin comprobar si el contenido es del tipo esperado."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:model_context_protocol_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D34DCE3E-FC83-4D4F-91BF-A2AD23B38838", "versionEndExcluding": "1.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}