CVE-2026-20205 PUBLISHED

Sensitive Information Disclosure in ''_internal'' index in Splunk MCP Server app

Assigner: cisco
Reserved: 08.10.2025 Published: 15.04.2026 Updated: 15.04.2026

In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk _internal index or possesses the high-privilege capability mcp_tool_admin could view users session and authorization tokens in clear text.<br><br>The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. <br><br>Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See Define roles on the Splunk platform with capabilities and Connecting to MCP Server and Admin settings in the Splunk documentation for more information.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.2

Product Status

Vendor Splunk
Product Splunk MCP Server
Versions
  • affected from 1.0 to 1.0.3 (excl.)

Credits

  • Charlie Huggard, Splunk

References

Problem Types

  • Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. cwe