CVE-2026-76404

9.1 Critique

Publiée le 20/08/2026 à 00:17 · Modifiée le 24/08/2026 à 20:37 · Analysée par le NVD · Source : psirt@cisco.com

Description

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.

Traduire en français

Produits concernés

Splunk MCP Server app
Splunk model context protocol server

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	psirt@cisco.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-502

Références

https://advisory.splunk.com/advisories/SVD-2026-0808 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories