Splunk MCP Server vulnerabilities

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.

In Splunk MCP Server versions below 1.2.1, the server could send the Splunk platform authentication token of a user who runs a custom API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it to access data and perform actions as the user who ran the tool. Successful exploitation requires a user with a role containing the mcp_tool_execute capability to run a custom API tool configured by another user.

In Splunk MCP Server app versions below 0.2.4, a user with access to the 'run_splunk_query' Model Context Protocol (MCP) tool could bypass the SPL command allowlist controls in MCP by embedding SPL commands as sub-searches, leading to unauthorized actions beyond the intended MCP restrictions.