Splunk Mcp Server
Monthly
Splunk MCP Server below version 1.0.3 logs session and authorization tokens in clear text within the `_internal` index, exposing them to any user with access to that index or the high-privilege `mcp_tool_admin` capability. A remote attacker with high privileges can view these tokens via the Splunk search interface, enabling session hijacking and impersonation of other users. No public exploit is identified at time of analysis, and the EPSS score of 0.04% indicates very low near-term exploitation probability.
Splunk MCP Server below version 1.0.3 logs session and authorization tokens in clear text within the `_internal` index, exposing them to any user with access to that index or the high-privilege `mcp_tool_admin` capability. A remote attacker with high privileges can view these tokens via the Splunk search interface, enabling session hijacking and impersonation of other users. No public exploit is identified at time of analysis, and the EPSS score of 0.04% indicates very low near-term exploitation probability.