Splunk has released security updates for 17 vulnerabilities affecting several apps and add-ons, including Splunk MCP Server, Splunk AI Toolkit, and Splunk Connect for Kafka.
The most severe issue, tracked as CVE-2026-76404, is a critical splunk mcp server rce (remote code execution) vulnerability with a CVSS score of 9.1. The August 2026 advisory also covers Cisco Talos Intelligence for Enterprise Security Cloud and Splunk On-Call (VictorOps).
Organizations using the affected components should prioritize upgrades, especially where administrative interfaces, REST APIs, or AI model-management features are exposed to untrusted users or networks.
Splunk Patches Security Flaws
CVE-2026-76404 affects Splunk MCP Server app versions earlier than 1.2.1. Splunk said an authenticated user with the admin role could execute arbitrary commands on the underlying operating system.
The flaw exists in the app’s credential-management component. Missing input validation allows unsafe deserialization of stored data without confirming that the supplied content has the expected type.
This creates a path for malicious serialized objects to execute commands. The vulnerability is categorized as CWE-502, or deserialization of untrusted data. Administrators should upgrade the Splunk MCP Server app to version 1.2.1 immediately.
Until patching is complete, Splunk recommends disabling or removing the app. Splunk AI Toolkit received fixes for nine vulnerabilities, including several high-severity access-control and code-execution flaws.
The most serious, CVE-2026-76395, carries a CVSS score of 8.8 and could allow a user with the power role to run arbitrary code on a Splunk server by loading a crafted model containing malicious sparse matrix data. The issue stems from unsafe deserialization of embedded pickle content.
Other AI Toolkit flaws could allow lower-privileged users to perform searches with system-level privileges, manage containers and connections without proper authorization, access or delete other users’ experiment history, and modify scheduled searches that run under the search owner’s permissions.
Splunk AI Toolkit versions below 6.0.0 are affected by most of these issues, while two flaws affect versions below 6.0.1. Users on the 5.7 release line should upgrade to version 6.0.0, while users already on version 6.0 should move to 6.0.1.
Complete Vulnerability Summary (Mobile-Friendly)
Cisco Talos Intelligence
- CVE-2026-76389 (High – CVSS 8.8)
Issue: SSRF may expose tokens. Fixed Version:1.0.3 - CVE-2026-76390 (Medium – CVSS 5.3)
Issue: OpenAPI spec exposure. Fixed Version:1.0.3
Splunk AI Toolkit
- CVE-2026-76391 (High – CVSS 8.3)
Issue: System-level search access. Fixed Version:6.0.0 - CVE-2026-76392 (Medium – CVSS 5.4)
Issue: Predictable credentials. Fixed Version:6.0.0 - CVE-2026-76393 (Medium – CVSS 5.9)
Issue: Model replacement via race condition. Fixed Version:6.0.0 - CVE-2026-76394 (High – CVSS 8.3)
Issue: Unauthorized container control. Fixed Version:6.0.0 - CVE-2026-76395 (High – CVSS 8.8)
Issue: Malicious model RCE via unsafe pickle deserialization. Fixed Version:6.0.0 - CVE-2026-76396 (High – CVSS 7.5)
Issue: Unsafe model deserialization. Fixed Version:6.0.0 - CVE-2026-76397 (High – CVSS 8.1)
Issue: Unauthorized experiment data access. Fixed Version:6.0.0 - CVE-2026-76398 (Medium – CVSS 4.3)
Issue: Unauthorized history deletion. Fixed Version:6.0.1 - CVE-2026-76399 (High – CVSS 8.1)
Issue: Scheduled search manipulation. Fixed Version:6.0.1
Splunk Connect for Kafka
- CVE-2026-76400 (Medium – CVSS 5.9)
Issue: Event delivery disruption. Fixed Version:2.2.7 - CVE-2026-76401 (Medium – CVSS 5.9)
Issue: Connector worker DoS. Fixed Version:2.2.7 - CVE-2026-76402 (High – CVSS 8.2)
Issue: Credential exposure via HEC. Fixed Version:2.2.7 - CVE-2026-76403 (High – CVSS 7.4)
Issue: Data interception/modification. Fixed Version:2.2.7
MCP Server and VictorOps
- CVE-2026-76404 (Critical – CVSS 9.1)
Issue: OS command execution (RCE). Fixed Version:1.2.1 - CVE-2026-76405 (Medium – CVSS 4.3)
Issue: Partial API key exposure in Splunk On-Call. Fixed Version:1.0.43
Splunk Connect for Kafka version 2.2.7 addresses four vulnerabilities. These include an SSRF flaw, CVE-2026-76402, rated 8.2, which could allow an unauthenticated attacker with access to the Kafka Connect REST API to configure a non-secure HTTP Event Collector endpoint and capture connector authentication credentials.
The Kafka fixes also address two denial-of-service issues and improper certificate validation in Kerberos-authenticated HTTP Event Collector deployments.
Splunk advises restricting Kafka Connect REST API access to trusted administrative systems and networks, enforcing secure transport for HTTP Event Collector endpoints, and applying finite retry limits.
Additional fixes include an SSRF vulnerability in Cisco Talos Intelligence for Enterprise Security Cloud and partial API key disclosure in Splunk On-Call (VictorOps). Updated versions are 1.0.3 for the Talos app and 1.0.43 for Splunk On-Call.
Organizations should inventory installed Splunk apps, apply relevant updates, restrict access to the management API, and review administrative and power-role assignments for signs of unnecessary privilege exposure.
Related Resource: Ensure your cloud telemetry and log management pipelines aren’t exposing your network to RCE threats. Learn more in our Agentic SOC vs Traditional SOC 2026 Guide.
FAQ: Splunk Vulnerabilities
What is the Splunk MCP Server RCE?
Tracked as CVE-2026-76404, it is a critical remote code execution vulnerability (CVSS 9.1) caused by unsafe deserialization in the Splunk MCP Server app. It allows authenticated admins to run arbitrary OS commands.
Is the Splunk AI Toolkit vulnerable?
Yes, Splunk patched nine vulnerabilities in the AI Toolkit, including CVE-2026-76395, which allows arbitrary code execution via maliciously crafted AI models containing unsafe pickle data.
Reported by CyberUpdates365 Desk
Delivering the latest insights on enterprise security, federal AI directives, and the future of IT infrastructure. Follow us for daily updates on how technology is reshaping the corporate landscape.
