splunk_advisories
- Source-provided label
- Not reported
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Oct 07, 2026 00:00 UTC
- Retrieved
- Oct 08, 2026 03:55 UTC
SVD-2026-1004: Security Vulnerability in Splunk MCP Server - September/October 2026
In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface (API) tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it to access data and perform actions as the user who ran the tool. Successful exploitation requires a us
Reference details
- Source category
- Vendor advisories
- Report title
SVD-2026-1004: Security Vulnerability in Splunk MCP Server - September/October 2026- First reported
- Oct 07, 2026 00:00 UTC
- Last reported
- Oct 07, 2026 00:00 UTC
- Catalog updated
- Oct 08, 2026 03:55 UTC
- Record ID
9dc8a09abcc7be335213e0309a5cda9a0da43954f8f3a1a45991179a5c43363b
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.