What happened
Published 2026-08-19 (CVSS 9.1, Critical) as part of Splunk's broader security-hardening release (SVD-2026-0808) covering 17 CVEs across Splunk apps/add-ons. The MCP Server app's credential-management component deserializes stored data without validating its type, letting a privileged user's crafted data trigger RCE.
Why it matters
MCP servers are the standardized bridge between LLM agents and enterprise tools; an RCE in this bridge — even requiring admin privileges — converts a compromised or malicious admin session into full host compromise, and demonstrates that MCP infrastructure needs the same rigor as any other privileged production service.
Attack vector
A Splunk user holding the 'admin' role can trigger deserialization of untrusted stored data in the MCP Server app's credential-management component (CWE-502), resulting in arbitrary OS command execution on the host running the MCP server.
Affected systems
Splunk MCP Server app versions below 1.2.1
Mitigation
Upgrade Splunk MCP Server app to version 1.2.1 or later per Splunk advisory SVD-2026-0808. Minimize administrative access, isolate MCP workloads, and audit MCP-server logs for unexpected command execution.