Splunk discloses command execution in its MCP Server app through unchecked deserialization in credential management

Splunk published advisory SVD-2026-0808 on 2026-08-19 for CVE-2026-76404, a remote code execution flaw in its own Splunk MCP Server app. The record is assigned by Cisco, Splunk's parent, which makes it the vendor's own account of the defect rather than a third-party filing.

The mechanism is deserialization of untrusted data. The advisory states that the app's credential management component deserialized stored data without checking whether the content was of the expected type, and that the missing input validation let a user holding the admin Splunk role execute arbitrary commands on the underlying operating system. Versions below 1.2.1 are affected and 1.2.1 carries the fix. The finding is credited to Kuniyoshi Noguchi (KuniNogu).

The severity deserves reading carefully. The 9.1 critical score comes from the CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, in which the privileges-required metric is High and the scope metric is Changed. In other words the vector is network-reachable and needs no user interaction, but it requires the Splunk admin role to begin with, and the score is lifted by the escape from the app's context to the host rather than by being reachable anonymously. What an admin gains is command execution on the operating system underneath Splunk, which that role does not otherwise confer.

MCP News does not yet publish a catalog record for the Splunk MCP Server app, so this story carries no entity cross-reference. The app has been added to the verification queue as a first-party candidate.