Threat · curated 24 Aug 2026
SVD-2026-0808 | Splunk Vulnerability Disclosure
First reported · updated · 2 reports splunk.com
Coverage timeline
Why it matters
CVE-2026-76404 gives attackers remote code execution against the Splunk MCP Server, the agentic tool-calling layer wiring LLMs into enterprise Splunk data, making prompt injection or malicious tool traffic a path to full host compromise unless defenders upgrade.
Splunk advisory SVD-2026-0808 discloses multiple vulnerabilities in Splunk apps including a critical (CVSS 9.1) remote code execution via untrusted-data deserialization (CVE-2026-76404) in the Splunk MCP Server app, plus several flaws in the Splunk AI Toolkit such as RCE in the Model Loading REST API (CVE-2026-76395), improper privilege management on agent run history (CVE-2026-76391), and missing authorization in container/connection management (CVE-2026-76394). Fixed versions are available for each affected app and add-on.
Summary
Splunk advisory SVD-2026-0808, published 2026-08-19, is a security hardening release disclosing 17 vulnerabilities across five Splunk apps and add-ons: Cisco Talos Intelligence for Enterprise Security Cloud, Splunk AI Toolkit, Splunk Connect for Kafka, Splunk MCP Server app, and Splunk On-Call (VictorOps). The highest severity is a critical CVSSv3.1 9.1 remote code execution flaw.[0]
The most serious issue, CVE-2026-76404, allows an admin-role user to execute arbitrary operating-system commands through insecure deserialization in the Splunk MCP Server app's credential management component. A second deserialization RCE (CVE-2026-76395) affects the Splunk AI Toolkit model loading path. The remaining flaws span SSRF, missing authorization, improper access control, improper privilege management, hard-coded credentials, improper certificate validation, denial of service, and information disclosure.[0]
All affected products have fixed versions available, and the advisory provides mitigations and workarounds for each vulnerability. No in-the-wild exploitation or threat-actor activity is described in the evidence.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-08-19 | Splunk published advisory SVD-2026-0808 (Security Hardening Release for Splunk Apps and Add-ons - August 2026), last updated the same day.[0] |
How it works
CVE-2026-76404 (Splunk MCP Server app, CWE-502, 9.1 Critical): a user with the admin Splunk role can execute arbitrary OS commands because the app's credential management component deserializes stored data without validating that the content is of the expected type. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects a scope change and full confidentiality, integrity, and availability impact.[0]
CVE-2026-76395 (Splunk AI Toolkit, CWE-502, 8.8 High): a user holding the power Splunk role can achieve code execution by loading a model file containing crafted sparse matrix data, because a model codec deserializes sparse matrix data without guarding against embedded pickle content.[0]
CVE-2026-76389 (Cisco Talos Intelligence, CWE-918, 8.8 High): a user with the get_talos_enrichment capability can send a crafted request to the Talos enrichment REST endpoint causing the instance to make an outbound request to an attacker-controlled server, because the endpoint accepts the destination for authenticated Splunk management requests from request data, potentially exposing tokens.[0]
CVE-2026-76391 (Splunk AI Toolkit, CWE-863, 8.3 High): the Agent Run History handler replaces the calling user's session key with a system authentication token before performing search operations, letting a low-privileged user run searches with system-level privileges and access or delete other users' search jobs.[0]
Splunk Connect for Kafka flaws stem from the Kafka Connect REST API: CVE-2026-76402 (SSRF, 8.2) sends credentials to non-secure HEC endpoints because endpoint validation does not require secure transport by default; CVE-2026-76403 (improper certificate validation, 7.4) fails to apply configured certificate validation when building the HTTP client for Kerberos auth; CVE-2026-76400 and CVE-2026-76401 (both 5.9 DoS) arise from unbounded retry handling and unbounded regular-expression evaluation during timestamp extraction.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Splunk MCP Server app | Below 1.2.1 (base 1.2) | Fixed in 1.2.1[0] |
| Splunk AI Toolkit | Below 6.0.1 (base 6.0) and below 6.0.0 (base 5.7) | Fixed in 6.0.1 and 6.0.0[0] |
| Cisco Talos Intelligence for Enterprise Security Cloud | Below 1.0.3 (base 1.0) | Fixed in 1.0.3[0] |
| Splunk Connect for Kafka | Below 2.2.7 (base 2.2) | Fixed in 2.2.7[0] |
| Splunk On-Call (VictorOps) | Below 1.0.43 (base 1.0) | Fixed in 1.0.43[0] |
Key takeaways
- Two of the most severe findings are insecure-deserialization RCEs (CVE-2026-76404 in the MCP Server app and CVE-2026-76395 in the AI Toolkit), underscoring the risk of unpickling untrusted or crafted model/credential data in Splunk extensions.[0]
- Many flaws are exploitable by low-privileged or non-admin Splunk users (privilege management, missing authorization, and access-control issues in the AI Toolkit), so role assignment alone should not be relied on as a security boundary until patched.[0]
- The advisory reports patched vulnerabilities with fixed versions and workarounds and contains no evidence of in-the-wild exploitation or attributed threat-actor activity.[0]
Defensive actions
- Upgrade each affected Splunk app or add-on to its fixed version (MCP Server 1.2.1, AI Toolkit 6.0.1/6.0.0, Cisco Talos Intelligence 1.0.3, Connect for Kafka 2.2.7, On-Call/VictorOps 1.0.43).: Upgrading to the fixed versions is the primary remediation for all 17 disclosed vulnerabilities, including the critical RCE flaws.[0]
- Where upgrade is not immediately possible, turn off or remove the affected app/add-on as a workaround.: Splunk's per-CVE mitigations advise disabling or removing the affected apps (AI Toolkit, MCP Server, Cisco Talos Intelligence, On-Call, and Connect for Kafka for CVE-2026-76403) to eliminate exposure.[0]
- Restrict access to the Kafka Connect REST API to trusted administrative hosts and networks, set a finite HEC retry limit, keep secure endpoint enforcement enabled, and disable timestamp extraction if unused.: These configuration workarounds mitigate the Splunk Connect for Kafka SSRF, certificate validation, and denial-of-service vulnerabilities (CVE-2026-76400 through CVE-2026-76403).[0]