Splunk MCP Server CVE-2026-76286

Exploitation requires a multi-user configuration: (1) an attacker must have the ability to create/configure a custom API tool in Splunk MCP Server and set its target URL to an endpoint they control, and (2) a separate victim user who holds a role containing the mcp_tool_execute capability must actively run that attacker-configured custom API tool. Only then is the victim's Splunk platform authentication token sent to the attacker URL. Limiting factors that reduce real-world risk: the victim's required mcp_tool_execute privilege, the mandatory user interaction (the victim must choose to run the tool), the attacker's need for tool-configuration privileges, and the dependency on the custom-tool feature being in use - this does not affect default deployments that do not use custom API tools.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS 3.1 base score of 5.3 (Medium) is held down by two strong limiting metrics: AC:H (the attack depends on a specific multi-user workflow coming together) and PR:H combined with UI:R (the attacker must already be a privileged tool author AND a separate, higher-value victim must voluntarily run the malicious tool). The upside for an attacker is significant - C:H reflects theft of a live Splunk platform authentication token that lets them impersonate the victim. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no POC was supplied, so this is no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting: a network-reachable SSRF-style token exfiltration (CWE-918) that is gated behind privilege and social-engineering requirements, which is exactly why a high-impact confidentiality flaw lands at only Medium severity. The primary real-world risk is insider/multi-tenant abuse rather than mass exploitation. Note: EPSS is absent and should be checked before final prioritization.

A user with rights to create custom API tools configures a tool pointing at a URL they control. A second, more privileged user holding the mcp_tool_execute capability runs that tool, causing Splunk MCP Server to transmit the running user's Splunk platform authentication token to the attacker-controlled URL. The attacker captures the token and replays it to read data and perform actions as the victim. No public exploit code was identified at time of analysis.