# Splunk MCP Server: a custom tool's URL could capture a user's token

> CVE-2026-76286 let a Splunk MCP Server custom API tool send the running user's platform token to a destination its author chose.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Splunk
- **Disclosed:** 2026-10-07
- **CVE:** CVE-2026-76286
- **CVSS:** 5.3
- **Affects:** Splunk MCP Server
- **Research by:** Kuniyoshi Noguchi
- **Primary source:** https://advisory.splunk.com/advisories/SVD-2026-1004
- **Page:** https://theinjection.dev/items/splunk-mcp-server-custom-tool-token-leak/

Splunk MCP Server below 1.2.1 could send the Splunk platform authentication token of whoever ran a custom API tool to the URL configured for that tool. Splunk fixed it in 1.2.1 and rates the issue 5.3, medium.

## What happened

Splunk published advisory SVD-2026-1004 on October 7, 2026, covering CVE-2026-76286 in Splunk MCP Server. Splunk acknowledges Kuniyoshi Noguchi for the report, rates the issue medium at 5.3, and classifies it as server-side request forgery under CWE-918. Version 1.2.1 fixes it.

## How it works

Splunk MCP Server lets users define custom API tools, and each tool carries the URL it calls. When a user ran such a tool, the server could attach that user's own Splunk platform authentication token to the request sent to the configured URL. Whoever controls that URL therefore receives the token of anyone else who runs the tool, and can then act with that user's permissions.

## Who is affected

Splunk MCP Server releases below 1.2.1 on the Splunk platform are affected. Splunk states that exploitation requires a user whose role carries the mcp_tool_execute capability to run a custom API tool that a different user configured.

## What to do

Upgrade Splunk MCP Server to 1.2.1 or later. Splunk's stated workaround is to turn off or remove the Splunk MCP Server app until the upgrade is possible. Review who holds the mcp_tool_execute capability and who can create custom API tools.

## Quick facts

- **Affected:** Splunk MCP Server below 1.2.1
- **Fixed in:** 1.2.1
- **CVE:** CVE-2026-76286
- **CVSS:** 5.3, medium, per Splunk
- **Found by:** Kuniyoshi Noguchi
- **Advisory:** SVD-2026-1004
- **Workaround:** Disable or remove the app

## Questions

### Which Splunk MCP Server versions does CVE-2026-76286 affect?

CVE-2026-76286 affects Splunk MCP Server versions below 1.2.1, and Splunk names 1.2.1 as the fixed release in advisory SVD-2026-1004. For anyone who cannot upgrade straight away, Splunk's stated workaround is to turn off or remove the Splunk MCP Server app, which takes the custom API tool path out of service entirely.

### What can an attacker do with a captured Splunk token?

Splunk states that whoever controls the URL set on a custom API tool could capture the Splunk platform authentication token of the user who ran that tool, and then act as that user. The reach of a stolen token matches that user's own Splunk permissions, so the damage depends on which roles run custom API tools.

### Who is able to exploit the Splunk MCP Server flaw?

Exploitation needs a Splunk user whose role includes the mcp_tool_execute capability to run a custom API tool that someone else configured, according to Splunk's advisory. Splunk scores the issue 5.3 with high attack complexity and high required privileges, which reflects that an attacker needs an existing foothold to plant the tool first.

## Sources

1. [Splunk Advisory](https://advisory.splunk.com/advisories/SVD-2026-1004)
2. [GitHub Advisory](https://github.com/advisories/GHSA-mgwr-9j5x-6w4x)