CVE-2025-20381
Splunk MCP Server
- Severity
- Medium
- Published
- December 3, 2025
- Last modified
- October 18, 2026
In Splunk MCP Server app versions below 0.2.4, a user with access to the "run_splunk_query" Model Context Protocol (MCP) tool could bypass the SPL command allowlist controls in MCP by embedding SPL commands as sub-searches, leading to unauthorized actions beyond the intended MCP restrictions.
CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
- CWE-863 Incorrect authorization
References
Listed in
More Splunk MCP Server CVEs
Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface (API) tool to the URL configured for that tool.
A user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system.
A user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_tool_admin` could view users session and authorization tokens in clear text.<br><br>The…