Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_tool_admin` could view users session and authorization tokens in clear text.<br><br>The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. <br><br>Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) and [Connecting to MCP Server and Admin settings](https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/connecting-to-mcp-server-and-admin-settings) in the Splunk documentation for more information.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-16 | 1 | Disclosure1 |
| 2026-04-21 | 2 | Disclosure1General1 |
| 2026-04-22 | 1 | Disclosure1 |
⚠️ Vulnerabilidades en productos Splunk ❗ CVE-2026-20205 ❗ CVE-2026-20204 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-splunk-4/ https://t.co/mXxe4zKS3C
Post summary
The tweet announces two new Splunk CVEs (CVE-2026-20205 and CVE-2026-20204) with a link to additional details, signifying a new vulnerability disclosure.
CVE-2026-32211 (Azure MCP, CVSS 8.6): Microsoft's reference server echoed bearer tokens in WWW-Authenticate headers on 401s. CVE-2026-20205 (Splunk MCP): cleartext HEC tokens in splunkd.log. Both = log-layer leaks.
Post summary
The post discloses two log‑layer leaks affecting Azure MCP and Splunk MCP, providing token exposure details and a CVSS rating, but contains no PoC, exploit, active exploitation, patch, or false‑positive information.
Primary sources: • Vercel KB: http://vercel.com/kb/bulletin/vercel-april-2026-security-incident • Trend Micro post-mortem • OX Security: http://ox.security/blog/mother-of-all-ai-supply-chains-2026-04-20 • CVE-2026-32211 (Azure MCP) • CVE-2026-20205 (Splunk MCP)
Post summary
The input lists references mentioning CVE‑2026‑32211 and CVE‑2026‑20205 but provides no concrete details about the vulnerabilities, exploits, patches, or active use.
CVE-2026-20205 In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_to… https://www.cve.org/CVERecord?id=CVE-2026-20205
Post summary
The post describes CVE‑2026‑20205 affecting Splunk MCP Server versions below 1.0.3, noting that users with certain high‑privilege roles can access the `_internal` index, but provides no PoC, exploit code, patch, or evidence of active exploitation.