CVE-2026-20205

{
  "id": "CVE-2026-20205",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-15T16:16:34.653",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_tool_admin` could view users session and authorization tokens in clear text.<br><br>The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. <br><br>Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) and [Connecting to MCP Server and Admin settings](https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/connecting-to-mcp-server-and-admin-settings) in the Splunk documentation for more information."
    },
    {
      "lang": "es",
      "value": "En versiones de la aplicación Splunk MCP Server anteriores a la 1.0.3, un usuario que posee un rol con acceso al índice “_internal” de Splunk o que posee la capacidad de alto privilegio “mcp_tool_admin” podría ver los tokens de sesión y autorización de los usuarios en texto claro.\n\nLa vulnerabilidad requeriría acceso local a los archivos de registro o acceso administrativo a los índices internos, que por defecto solo recibe el rol de administrador.\n\nRevise los roles y las capacidades en su instancia y restrinja el acceso a los índices internos a los roles de nivel de administrador. Consulte [Definir roles en la plataforma Splunk con capacidades](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) y [Conexión a MCP Server y configuración de administrador](https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/connecting-to-mcp-server-and-admin-settings) en la documentación de Splunk para obtener más información."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Splunk",
          "product": "Splunk MCP Server",
          "versions": [
            {
              "version": "1.0",
              "lessThan": "1.0.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-15T17:39:12.967528Z",
          "id": "CVE-2026-20205",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0407",
      "source": "[email protected]"
    }
  ]
}