Splunk has released security updates for 17 vulnerabilities affecting several apps and add-ons, including Splunk MCP Server, Splunk AI Toolkit, and Splunk Connect for Kafka.

The most severe issue, tracked as CVE-2026-76404, is a critical remote code execution vulnerability with a CVSS score of 9.1. The advisory, published on August 19, 2026, also covers Cisco Talos Intelligence for Enterprise Security Cloud and Splunk On-Call (VictorOps).

Organizations using the affected components should prioritize upgrades, especially where administrative interfaces, REST APIs, or AI model-management features are exposed to untrusted users or networks.

Splunk Patches Security Flaws

CVE-2026-76404 affects Splunk MCP Server app versions earlier than 1.2.1. Splunk said an authenticated user with the admin role could execute arbitrary commands on the underlying operating system.

The flaw exists in the app’s credential-management component. Missing input validation allows unsafe deserialization of stored data without confirming that the supplied content has the expected type.

This creates a path for malicious serialized objects to execute commands. The vulnerability is categorized as CWE-502, or deserialization of untrusted data . Administrators should upgrade the Splunk MCP Server app to version 1.2.1.

Until patching is complete, Splunk recommends disabling or removing the app. Splunk AI Toolkit received fixes for nine vulnerabilities, including several high-severity access-control and code-execution flaws.

The most serious, CVE-2026-76395, carries a CVSS score of 8.8 and could allow a user with the power role to run arbitrary code on a Splunk server by loading a crafted model containing malicious sparse matrix data. The issue stems from unsafe deserialization of embedded pickle content.

Other AI Toolkit flaws could allow lower-privileged users to perform searches with system-level privileges, manage containers and connections without proper authorization, access or delete other users’ experiment history, and modify scheduled searches that run under the search owner’s permissions.

Splunk AI Toolkit versions below 6.0.0 are affected by most of these issues, while two flaws affect versions below 6.0.1. Users on the 5.7 release line should upgrade to version 6.0.0, while users already on version 6.0 should move to 6.0.1.

Cisco Talos Intelligence

CVE	Severity	Score	Key Details	Fixed
CVE-2026-76389	High	8.8	SSRF may expose tokens.	1.0.3
CVE-2026-76390	Medium	5.3	OpenAPI spec exposure.	1.0.3

Splunk AI Toolkit

CVE	Severity	Score	Key Details	Fixed
CVE-2026-76391	High	8.3	System-level search access.	6.0.0
CVE-2026-76392	Medium	5.4	Predictable credentials.	6.0.0
CVE-2026-76393	Medium	5.9	Model replacement via race condition.	6.0.0
CVE-2026-76394	High	8.3	Unauthorized container control.	6.0.0
CVE-2026-76395	High	8.8	Malicious model RCE.	6.0.0
CVE-2026-76396	High	7.5	Unsafe model deserialization.	6.0.0
CVE-2026-76397	High	8.1	Experiment data access.	6.0.0
CVE-2026-76398	Medium	4.3	Unauthorized history deletion.	6.0.1
CVE-2026-76399	High	8.1	Scheduled search manipulation.	6.0.1

Splunk Connect for Kafka

CVE	Severity	Score	Key Details	Fixed
CVE-2026-76400	Medium	5.9	Event delivery disruption.	2.2.7
CVE-2026-76401	Medium	5.9	Connector worker DoS.	2.2.7
CVE-2026-76402	High	8.2	Credential exposure via HEC.	2.2.7
CVE-2026-76403	High	7.4	Data interception/modification.	2.2.7

MCP Server and VictorOps

CVE	Severity	Score	Key Details	Fixed
CVE-2026-76404	Critical	9.1	OS command execution.	1.2.1
CVE-2026-76405	Medium	4.3	API key exposure.	1.0.43

Splunk Connect for Kafka version 2.2.7 addresses four vulnerabilities. These include an SSRF flaw, CVE-2026-76402, rated 8.2, which could allow an unauthenticated attacker with access to the Kafka Connect REST API to configure a non-secure HTTP Event Collector endpoint and capture connector authentication credentials.

The Kafka fixes also address two denial-of-service issues and improper certificate validation in Kerberos-authenticated HTTP Event Collector deployments.

Splunk advises restricting Kafka Connect REST API access to trusted administrative systems and networks, enforcing secure transport for HTTP Event Collector endpoints, and applying finite retry limits.

Additional fixes include an SSRF vulnerability in Cisco Talos Intelligence for Enterprise Security Cloud and partial API key disclosure in Splunk On-Call (VictorOps). Updated versions are 1.0.3 for the Talos app and 1.0.43 for Splunk On-Call.

Organizations should inventory installed Splunk apps, apply relevant updates, restrict access to the management API, and review administrative and power-role assignments for signs of unnecessary privilege exposure.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Splunk Patches Critical MCP Server RCE and 16 Other Security Flaws Across AI Toolkit, Kafka Apps appeared first on Cyber Security News.