← News
/DISPATCH · 2026-08-21

Splunk Ships 17 Security Fixes: MCP Server CVE-2026-76404 Deserialization RCE Scores 9.1; Multiple High-Severity Pickle Risks in AI Toolkit

Splunk published 17 security updates on August 19 covering MCP Server, AI Toolkit, Connect for Kafka, Talos Intelligence, and VictorOps. Most severe: CVE-2026-76404, a CWE-502 deserialization flaw in the MCP Server credential-management module, CVSS 9.1. An admin-role user can execute arbitrary commands. Upgrade to 1.2.1 immediately.

Splunk published 17 security updates on August 19, 2026, covering Splunk MCP Server, Splunk AI Toolkit, Splunk Connect for Kafka, Cisco Talos Intelligence for Enterprise Security Cloud, Splunk On-Call (VictorOps), and other product lines. Most severe: CVE-2026-76404, a CWE-502 insecure deserialization vulnerability in the Splunk MCP Server credential-management component, CVSS 9.1. An authenticated user with the admin role can execute arbitrary system commands. Upgrade to 1.2.1 immediately and disable the MCP Server app until patched.

Incident Overview

Splunk MCP Server is the Model Context Protocol access component for AI agents and ops use cases. It lets external AI tools call Splunk data query, alert management, and credential storage over a standard protocol. The flaw is in MCP Server's credential-management module: CVE-2026-76404, CVSS 9.1, affects all versions prior to 1.2.1. Splunk's fix guidance is direct—disable or uninstall the MCP Server app until patched. The attack surface cannot be eliminated by configuration change.

Of the 17 vulnerabilities:

Technical Details

Root cause of CVE-2026-76404: Splunk MCP Server credential-management component lacks input validation and performs insecure deserialization of stored data without verifying the incoming content is of the expected type (CWE-502). An attacker with the admin role can craft a malicious serialized object that triggers arbitrary OS commands on deserialize. The bar is obtaining a Splunk admin role first, which does not reduce risk—admin roles are not scarce in most enterprise Splunk deployments.

AI Toolkit's core bug CVE-2026-76395 CVSS 8.8 is in the model-load path: a user with the power role can load a model file containing malicious sparse-matrix pickle-serialized data and execute arbitrary code on the Splunk server. Classic model-as-attack-vector, same lineage as 2024 PyTorch / TensorFlow cases. Remaining AI Toolkit CVEs:

Kafka connector CVE-2026-76402 SSRF lets an attacker, without authentication, reach the Kafka Connect REST API, configure an unsafe HEC (HTTP Event Collector) endpoint, and capture the connector's auth credentials. Common path in Splunk for credential handoff—anyone who can reach the Connect node can obtain credentials for every downstream HEC-connected system.

Impact Assessment

Splunk sits at the data-aggregation core of enterprise SIEM. Logs, alerts, and security telemetry from all IT systems flow into it. Compromise of MCP Server or the Kafka connector lets an attacker use Splunk query capability to laterally read data from every collected system—endpoints, mail, AD, cloud audit, IAM credentials. Splunk search rights (power role) already enable cross-dataset queries, so CVE-2026-76391 (system-level search) hits harder than its CVSS number.

More broadly, the 17-CVE mix shows the MCP/AI protocol stack entering the mainstream attack surface. MCP Server is the first MCP-class component on Splunk's critical RCE list, joining LiteLLM, C2Looper, Claude Code and others on the 2H 2026 AI infrastructure risk map. AI Toolkit pickle RCE CVE-2026-76395 is a textbook model supply-chain sample: model files as the new attack vehicle, forming a code-as-entry-point security model alongside the Rust crate attack.

For large Splunk shops, patch complexity is high: MCP Server before 1.2.1 is an optional app, not default-on, but many AI ops teams already wired MCP Server into Claude/Cursor/Cline clients. Inventory first, then upgrade host by host.

Remediation

Per Splunk official guidance and enterprise practice, proceed in this order:

Teams that have not enabled MCP Server should weigh benefit vs. exposure first. MCP is still evolving; security governance is less mature than Web/REST APIs. Early adoption expands the enterprise SIEM attack surface.

References