Splunk has released security updates for 17 vulnerabilities affecting several apps and add-ons, including Splunk MCP Server, Splunk AI Toolkit, and Splunk Connect for Kafka.
The most severe issue, tracked as CVE-2026-76404, is a critical remote code execution vulnerability with a CVSS score of 9.1. The advisory, published on August 19, 2026, also covers Cisco Talos Intelligence for Enterprise Security Cloud and Splunk On-Call (VictorOps).
Organizations using the affected components should prioritize upgrades, especially where administrative interfaces, REST APIs, or AI model-management features are exposed to untrusted users or networks.
Splunk Patches Security Flaws
CVE-2026-76404 affects Splunk MCP Server app versions earlier than 1.2.1. Splunk said an authenticated user with the admin role could execute arbitrary commands on the underlying operating system.
The flaw exists in the app’s credential-management component. Missing input validation allows unsafe deserialization of stored data without confirming that the supplied content has the expected type.
This creates a path for malicious serialized objects to execute commands. The vulnerability is categorized as CWE-502, or deserialization of untrusted data. Administrators should upgrade the Splunk MCP Server app to version 1.2.1.
Until patching is complete, Splunk recommends disabling or removing the app. Splunk AI Toolkit received fixes for nine vulnerabilities, including several high-severity access-control and code-execution flaws.
The most serious, CVE-2026-76395, carries a CVSS score of 8.8 and could allow a user with the power role to run arbitrary code on a Splunk server by loading a crafted model containing malicious sparse matrix data. The issue stems from unsafe deserialization of embedded pickle content.
Other AI Toolkit flaws could allow lower-privileged users to perform searches with system-level privileges, manage containers and connections without proper authorization, access or delete other users’ experiment history, and modify scheduled searches that run under the search owner’s permissions.
Splunk AI Toolkit versions below 6.0.0 are affected by most of these issues, while two flaws affect versions below 6.0.1. Users on the 5.7 release line should upgrade to version 6.0.0, while users already on version 6.0 should move to 6.0.1.
Cisco Talos Intelligence
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76389 | High | 8.8 | SSRF may expose tokens. | 1.0.3 |
| CVE-2026-76390 | Medium | 5.3 | OpenAPI spec exposure. | 1.0.3 |
Splunk AI Toolkit
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76391 | High | 8.3 | System-level search access. | 6.0.0 |
| CVE-2026-76392 | Medium | 5.4 | Predictable credentials. | 6.0.0 |
| CVE-2026-76393 | Medium | 5.9 | Model replacement via race condition. | 6.0.0 |
| CVE-2026-76394 | High | 8.3 | Unauthorized container control. | 6.0.0 |
| CVE-2026-76395 | High | 8.8 | Malicious model RCE. | 6.0.0 |
| CVE-2026-76396 | High | 7.5 | Unsafe model deserialization. | 6.0.0 |
| CVE-2026-76397 | High | 8.1 | Experiment data access. | 6.0.0 |
| CVE-2026-76398 | Medium | 4.3 | Unauthorized history deletion. | 6.0.1 |
| CVE-2026-76399 | High | 8.1 | Scheduled search manipulation. | 6.0.1 |
Splunk Connect for Kafka
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76400 | Medium | 5.9 | Event delivery disruption. | 2.2.7 |
| CVE-2026-76401 | Medium | 5.9 | Connector worker DoS. | 2.2.7 |
| CVE-2026-76402 | High | 8.2 | Credential exposure via HEC. | 2.2.7 |
| CVE-2026-76403 | High | 7.4 | Data interception/modification. | 2.2.7 |
MCP Server and VictorOps
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76404 | Critical | 9.1 | OS command execution. | 1.2.1 |
| CVE-2026-76405 | Medium | 4.3 | API key exposure. | 1.0.43 |
Splunk Connect for Kafka version 2.2.7 addresses four vulnerabilities. These include an SSRF flaw, CVE-2026-76402, rated 8.2, which could allow an unauthenticated attacker with access to the Kafka Connect REST API to configure a non-secure HTTP Event Collector endpoint and capture connector authentication credentials.
The Kafka fixes also address two denial-of-service issues and improper certificate validation in Kerberos-authenticated HTTP Event Collector deployments.
Splunk advises restricting Kafka Connect REST API access to trusted administrative systems and networks, enforcing secure transport for HTTP Event Collector endpoints, and applying finite retry limits.
Additional fixes include an SSRF vulnerability in Cisco Talos Intelligence for Enterprise Security Cloud and partial API key disclosure in Splunk On-Call (VictorOps). Updated versions are 1.0.3 for the Talos app and 1.0.43 for Splunk On-Call.
Organizations should inventory installed Splunk apps, apply relevant updates, restrict access to the management API, and review administrative and power-role assignments for signs of unnecessary privilege exposure.