Splunk Patches Critical RCE in MCP Server, 16 Flaws in AI Toolkit and Kafka Apps

Key Takeaways

• Splunk has released patches for 17 vulnerabilities across several applications and add-ons.
• The most critical flaw, CVE-2026-76404, is a remote code execution (RCE) vulnerability in Splunk MCP Server, rated 9.1 CVSS.
• Nine vulnerabilities, including high-severity RCE and access control issues, affect the Splunk AI Toolkit.
• Four flaws, including an SSRF leading to credential exposure, were addressed in Splunk Connect for Kafka.
• Organizations are urged to update affected components immediately, especially those exposed to untrusted networks or users.

Splunk has issued urgent security updates addressing a total of 17 vulnerabilities across multiple products, including Splunk MCP Server, Splunk AI Toolkit, and Splunk Connect for Kafka. The patches target a range of weaknesses, from critical remote code execution to high-severity access control and information disclosure flaws, as detailed in an advisory published on August 19, 2026. Other affected components include Cisco Talos Intelligence for Enterprise Security Cloud and Splunk On-Call (VictorOps).

Security teams should prioritize applying these updates, particularly for systems where administrative interfaces, REST APIs, or AI model management features are accessible to potentially untrusted users or external networks.

Critical RCE in Splunk MCP Server

The most severe vulnerability identified is CVE-2026-76404, a critical remote code execution flaw in Splunk MCP Server with a CVSS score of 9.1. This vulnerability affects versions of the Splunk MCP Server app prior to 1.2.1.

According to Splunk, an authenticated user possessing the administrative role could leverage this flaw to execute arbitrary commands on the underlying operating system. The weakness resides within the app’s credential management component, specifically due to a lack of input validation. This oversight permits unsafe deserialization of stored data without proper type verification, creating an avenue for malicious serialized objects to execute commands. The vulnerability is classified as CWE-502, “Deserialization of Untrusted Data.”

Administrators must upgrade the Splunk MCP Server app to version 1.2.1 immediately. As an interim mitigation, Splunk recommends disabling or removing the app until the patch can be applied.

Extensive Flaws in Splunk AI Toolkit

The Splunk AI Toolkit received fixes for nine distinct vulnerabilities, many of which are rated high severity and involve access control bypasses or code execution. The most critical among these is CVE-2026-76395, scoring 8.8 CVSS. This vulnerability could enable a user with the “power” role to execute arbitrary code on a Splunk server by loading a specially crafted model containing malicious sparse matrix data. This issue also stems from unsafe deserialization, specifically of embedded pickle content.

Other vulnerabilities in the AI Toolkit could allow lower-privileged users to conduct searches with system-level privileges, manage containers and connections without proper authorization, access or delete other users’ experiment history, and even modify scheduled searches configured to run under the search owner’s permissions.

Most of these issues affect Splunk AI Toolkit versions older than 6.0.0, while two specific flaws impact versions before 6.0.1. Users currently on the 5.7 release line should upgrade to version 6.0.0, and those already running version 6.0 should update to 6.0.1.

Cisco Talos Intelligence

Splunk AI Toolkit

Splunk Connect for Kafka

MCP Server and VictorOps

Vulnerabilities in Splunk Connect for Kafka

Splunk Connect for Kafka version 2.2.7 resolves four identified vulnerabilities. Among these is CVE-2026-76402, a high-severity Server-Side Request Forgery (SSRF) flaw with a CVSS score of 8.2. This vulnerability could permit an unauthenticated attacker, with access to the Kafka Connect REST API, to configure a non-secure HTTP Event Collector (HEC) endpoint. This misconfiguration could then be exploited to capture sensitive connector authentication credentials.

The Kafka updates also address two denial-of-service (DoS) issues and an improper certificate validation vulnerability affecting Kerberos-authenticated HTTP Event Collector deployments.

To mitigate risks for Kafka deployments, Splunk recommends restricting access to the Kafka Connect REST API to trusted administrative systems and networks, enforcing the use of secure transport for HTTP Event Collector endpoints, and implementing finite retry limits to prevent brute-force attacks.

Additional Patches

Further updates include a Server-Side Request Forgery (SSRF) vulnerability found in Cisco Talos Intelligence for Enterprise Security Cloud, and a partial API key disclosure issue within Splunk On-Call (VictorOps). The updated version for the Talos app is 1.0.3, and for Splunk On-Call, it is 1.0.43.

What You Should Do

• Inventory Splunk Apps: Identify all installed Splunk apps and add-ons to determine which are affected by these advisories.
• Apply Updates: Prioritize and apply all relevant security updates to bring affected components to the patched versions (e.g., Splunk MCP Server to 1.2.1, Splunk AI Toolkit to 6.0.0 or 6.0.1, Splunk Connect for Kafka to 2.2.7, Cisco Talos Intelligence to 1.0.3, and Splunk On-Call to 1.0.43).
• Restrict Access: Limit access to Splunk management APIs, Kafka Connect REST APIs, and administrative interfaces to trusted networks and administrative personnel only.
• Review Privileges: Periodically review and audit administrative and “power” role assignments within Splunk to ensure that no unnecessary privileges are granted.
• Disable or Remove: As a temporary measure for Splunk MCP Server, consider disabling or removing the app if immediate patching is not feasible.
• Secure HEC Endpoints: Ensure all HTTP Event Collector endpoints use secure transport protocols and implement finite retry limits to prevent credential harvesting.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.