Access Control Vulnerability in Splunk MCP Server App
CVE-2025-20381

5.4MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Mcp Server
Vendor
CVE Published:
3 December 2025

What is CVE-2025-20381?

The Splunk MCP Server app has a significant access control vulnerability in versions prior to 0.2.4. This flaw allows users with appropriate access to the 'run_splunk_query' Model Context Protocol (MCP) tool to bypass existing SPL command allowlist controls. By embedding SPL commands as sub-searches, users can execute unauthorized actions that extend beyond the designed constraints of the MCP, potentially compromising the security and integrity of the application.

Affected Version(s)

Splunk MCP Server 0.2 < 0.2.4

References

https://advisory.splunk.com/advisories/SVD-2025-1210

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Saket Pandey, Splunk
JSON
.