CVE-2025-20381
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In Splunk MCP Server app versions below 0.2.4, a user with access to the 'run_splunk_query' Model Context Protocol (MCP) tool could bypass the SPL command allowlist controls in MCP by embedding SPL commands as sub-searches, leading to unauthorized actions beyond the intended MCP restrictions.
Risk Assessment
A user with access to the MCP tool can execute unauthorized SPL commands, potentially accessing data or performing actions beyond their privileges.
Recommendation
Update Splunk MCP Server to version 0.2.4 or later to restore proper enforcement of the SPL command allowlist.
Other vulnerabilities in Splunk MCP Server
See all- CVE-2026-76404Critical
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.
- CVE-2026-76286Medium
In Splunk MCP Server versions below 1.2.1, the server could send the Splunk platform authentication token of a user who runs a custom API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it to access data and perform actions as the user who ran the tool. Successful exploitation requires a user with a role containing the mcp_tool_execute capability to run a custom API tool configured by another user.
Original NVD description (English source)
In Splunk MCP Server app versions below 0.2.4, a user with access to the "run_splunk_query" Model Context Protocol (MCP) tool could bypass the SPL command allowlist controls in MCP by embedding SPL commands as sub-searches, leading to unauthorized actions beyond the intended MCP restrictions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS