PT-2026-33067 · Splunk · Splunk Mcp Server

Published 2026-04-15 · Updated 2026-04-21 · CVE-2026-20205

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Splunk MCP Server app versions prior to 1.0.3

Description A user with a role that has access to the Splunk internal index or the high-privilege capability mcp tool admin can view user session and authorization tokens in clear text. This issue requires either local access to log files or administrative access to internal indexes, which are typically restricted to the admin role by default.

Recommendations Update to version 1.0.3 or later. Review roles and capabilities on the instance and restrict internal index access to administrator-level roles.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-20205

Affected Products

Splunk Mcp Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-20205 · Security Note
• https://twitter.com/Sattyamjjain/status/2046511528984375587 · Twitter Post
• https://twitter.com/CVEnew/status/2044737973627810126 · Twitter Post
• https://advisory.splunk.com/advisories/SVD-2026-0407 · Note