CVE-2026-20205

The record

In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_tool_admin` could view users session and authorization tokens in clear text.<br><br>The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. <br><br>Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) and [Connecting to MCP Server and Admin settings](https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/connecting-to-mcp-server-and-admin-settings) in the Splunk documentation for more information.

Affected packages

Related vulnerabilities

• CVE-2026-62347 Element Call is a native Matrix video conferencing application. CWE-532
• CVE-2026-119117 Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for… CWE-532
• CVE-2026-119290 Zuke is a code-first, strongly typed build automation system for Deno. CWE-532
• CVE-2026-59388 Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances… CWE-532
• CVE-2026-90861 Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may… CWE-532
• CVE-2026-118647 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable… CWE-532
• CVE-2026-79656 A user with read access to Grafana's server logs, or to a log store they are shipped to… CWE-532
• CVE-2026-116691 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-532