SPL commands allowlist controls bypass in Splunk MCP Server app through "run_splunk_query" MCP tool

Description

In Splunk MCP Server app versions below 0.2.4, a user with access to the "run_splunk_query" Model Context Protocol (MCP) tool could bypass the SPL command allowlist controls in MCP by embedding SPL commands as sub-searches, leading to unauthorized actions beyond the intended MCP restrictions.

Scores

EPSS (exploitation in 30 days)

0.24% · top 85% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• CWE-863: The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. (opens in a new tab)All about CWE-863 and its CVEs

Affected products

• Splunk · Splunk MCP Server

  • affected 0.2 – < 0.2.4

References (1)

• https://advisory.splunk.com/advisories/SVD-2025-1210 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-20381](https://trackcve.app/badge/CVE-2025-20381.svg)](https://trackcve.app/cve/CVE-2025-20381)

Record last updated 3 Dec 2025, 21:29 UTC.