CVE-2026-20205
In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk index or possesses the high-privilege capability could view users ses…
Published Apr 15, 2026 · updated Jun 17, 2026
In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk index or possesses the high-privilege capability could view users session and authorization tokens in clear text. The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) and [Connecting to MCP Server and Admin settings](https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/connecting-to-mcp-server-and-admin-settings) in the Splunk documentation for more information.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 15, 2026 · NIST NVD
Detected
In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk index or possesses the high-privilege capability could view users session and authorization tokens in clear text. The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. Review roles and capabilit
Jun 17, 2026 · NIST NVD
Updated
In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk index or possesses the high-privilege capability could view users session and authorization tokens in clear text. The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. Review roles and capabilit
Sources
- CVE.orgVulnerability recordCVE-2026-20205
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-20205
In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk index or possesses the high-privilege capability could view users session and authorization tokens in clear text. The vulnerability would require
nvd.nist.gov