On 19 August 2026, Splunk published advisory SVD-2026-0808, covering 17 vulnerabilities across five Splunk apps and add-ons. The highest score is 9.1, for CVE-2026-76404, remote code execution through deserialization in the Splunk MCP Server app. Two of the affected apps are AI-facing: the MCP Server app and the Splunk AI Toolkit, which has 9 of the 17 CVEs.
The advisory was updated on 7 October 2026 only to align its title with Cisco's advisory standards.
What's affected
| Product | Affected | Fixed |
|---|---|---|
| Splunk MCP Server app | below 1.2.1 | 1.2.1 |
| Splunk AI Toolkit 6.0 line | below 6.0.1 | 6.0.1 |
| Splunk AI Toolkit 5.7 line | below 6.0.0 | 6.0.0 |
| Cisco Talos Intelligence for Enterprise Security Cloud | below 1.0.3 | 1.0.3 |
| Splunk Connect for Kafka | below 2.2.7 | 2.2.7 |
| Splunk On-Call (VictorOps) | below 1.0.43 | 1.0.43 |
The MCP Server flaw requires a user with the Splunk admin role. It comes from missing input validation in the credential management component, which deserializes stored data without checking that it is the expected type. That is CWE-502, and NVD scores it 9.1.
The AI Toolkit entries are more numerous. Highlights from the advisory table:
- CVE-2026-76395: remote code execution through deserialization in the model loading REST API, CVSS 8.8.
- CVE-2026-76391: Agent Run History runs with system-level privileges, CVSS 8.3.
- CVE-2026-76394: missing authorization in container and connection management through the REST API, CVSS 8.3.
- CVE-2026-76392: hard-coded or predictable credentials for connected container services, CVSS 5.4.
All AI Toolkit CVEs apply below 6.0.0, except CVE-2026-76398 and CVE-2026-76399, which apply below 6.0.1.
How to check if you're exposed
In Splunk Web, open Manage Apps and read the version of each app listed above. From the command line on a search head:
$SPLUNK_HOME/bin/splunk display app
ls $SPLUNK_HOME/etc/apps | grep -iE "mcp|ai-toolkit|Splunk_ML|talos|kafka|victorops"
Then check who holds the admin role, since the MCP Server RCE needs it, and whether the AI Toolkit REST endpoints are reachable by roles you did not intend.
What to do now
- Upgrade the Splunk MCP Server app to 1.2.1 and the AI Toolkit to 6.0.1 (or 6.0.0 on the 5.7 line).
- If you cannot upgrade yet, Splunk's workaround for the MCP Server RCE is to turn off or remove the app. For AI Toolkit CVEs 76391 to 76399 it is the same, with the caveat that SPL commands and model operations stop and dependent apps may break.
- Review the
adminrole members and remove people who do not need it. - For Connect for Kafka, restrict Kafka Connect REST API access to trusted administrative hosts and set a finite HTTP Event Collector retry limit.
- Treat stored credentials the MCP Server app holds as exposed if an untrusted admin could have used the flaw. Rotate them.
How this could have been avoided
- Do not deserialize stored data without type checks. The MCP Server bug was a credential store read back as arbitrary objects. Strict parsing of expected fields prevents it.
- Keep the admin role small. The flaw needed
admin. Fewer admins means fewer accounts that can reach it. - Authorize every REST route. Several AI Toolkit findings are missing authorization or improper access control on model, experiment and container endpoints.
- Do not ship hard-coded service credentials. One AI Toolkit CVE exists because container services shared predictable credentials.
Why it matters
AI features are arriving as apps inside platforms teams already run, so they bring new REST endpoints, new model loading paths and new stored credentials into a product with a large admin surface. Each one needs the same review as any other code path that runs on the server.
Also notice what the advisory does not say. There is no listed exploitation, and the top score depends on an admin account. Prioritize accordingly: patch quickly, but start with the places where many people hold admin or where AI Toolkit's REST API is reachable from broad networks.
Quick check
Which MCP Server version fixes CVE-2026-76404?
1.2.1. Versions below it are affected, and the exploit requires the admin role.
What does Splunk suggest if you cannot patch the MCP Server app?
Turn off or remove the app.
