Clear Text Exposure in Splunk MCP Server App for Certain Roles

CVE-2026-20205

What is CVE-2026-20205?

In the Splunk MCP Server app prior to version 1.0.3, unauthorized users holding elevated roles could access sensitive information including session and authorization tokens in clear text. This issue primarily affects users who have either local access to server log files or administrative control over internal indexes, a privilege typically reserved for the admin role. It is crucial to audit roles and permissions on your Splunk instance, ensuring that access to the internal index is restricted to administrator-level roles only. For detailed guidance, refer to the Splunk documentation on defining roles and capabilities and connecting to the MCP Server.

References