Splunk's August batch: a 9.1 in the MCP server, a pickle in the AI Toolkit

Splunk published SVD-2026-0808, "Security Hardening Release for Splunk Apps and Add-ons - August 2026", on 2026-08-19. It covers 17 CVEs across five products, and eleven of them are in the two AI-branded ones: the Splunk MCP Server app and the Splunk AI Toolkit. The highest score in the batch, 9.1, belongs to the MCP server.

The critical: an admin-role RCE in the MCP server

CVE-2026-76404 carries a CVSSv3.1 score of 9.1 and affects Splunk MCP Server app versions below 1.2.1. The advisory's description is short: "In Splunk MCP Server app versions below 1.2.1, a user who holds the 'admin' Splunk role could execute arbitrary commands on the underlying operating system."

The root cause is named just as plainly: "missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type."

Two details matter for triage. First, this is not an unauthenticated path — it requires the admin Splunk role. That lowers the practical urgency for a well-segmented deployment and raises it sharply for anyone who has handed the admin role out broadly, or who fronts the MCP server with an agent that runs under admin credentials because that was the path of least resistance during a proof of concept. An MCP server exists to be driven by a model; if the model's identity holds admin, the precondition is satisfied by design.

Second, the vulnerable component is credential management. That is where an MCP server keeps the tokens it uses to reach everything else, so the blast radius of code execution there is not confined to the box.

Fix version is 1.2.1. Splunk's interim mitigation is unusually blunt: "Turn off or remove the Splunk MCP Server app."

Nine in the AI Toolkit, including a pickle

The Splunk AI Toolkit accounts for CVE-2026-76391 through CVE-2026-76399 — seven High and two Medium. Fix versions are 6.0.0 for most, and 6.0.1 for CVE-2026-76398 and CVE-2026-76399.

The one that should worry a defender most is CVE-2026-76395 (8.8, High), where the toolkit deserializes "sparse matrix data without guarding against embedded pickle content," enabling code execution. This is the classic Python data-science footgun: a serialized array format that is also an arbitrary-code format, reached through a path that looks like data loading. It is the same shape as the MCP server bug — trust placed in the type of stored bytes — appearing independently in a second product in the same release.

The rest form a coherent privilege-boundary cluster:

• CVE-2026-76391 (8.3) — improper privilege management lets non-admin users "run searches with system-level privileges" through Agent Run History.
• CVE-2026-76392 (5.4) — hardcoded credential generation lets users "obtain predictable or default credentials for connected container services."
• CVE-2026-76393 (5.9) — a race condition allows model overwriting through concurrent uploads, with "attacker-controlled content."
• CVE-2026-76394 (8.3) — "Low-privileged users could start, stop, and configure containers" through a REST API missing authorization checks.
• CVE-2026-76396 (7.5) — the apply search command lacks a risk designation, allowing scheduled searches to load models.
• CVE-2026-76397 (8.1) and CVE-2026-76398 (4.3) — power-role and non-admin users could read or delete other users' experiment history.
• CVE-2026-76399 (8.1) — power-role users could modify scheduled searches to "run arbitrary Search Processing Language."

Model overwriting via a race, containers controlled without authorization, models loaded from scheduled searches: taken together, these describe an ML workbench where the compute and model-artifact layer was never given the same authorization scaffolding as the search layer around it.

The rest of the batch

The advisory also fixes CVE-2026-76389 (8.8) and CVE-2026-76390 (5.3) in Cisco Talos Intelligence for Enterprise Security Cloud, fixed in 1.0.3; four in Splunk Connect for Kafka (CVE-2026-76400 through CVE-2026-76403, 5.9 to 8.2), fixed in 2.2.7; and CVE-2026-76405 (4.3) in Splunk On-Call, fixed in 1.0.43.

Remediation order

Upgrade the MCP Server app to 1.2.1, or turn it off until you can. Upgrade the AI Toolkit to 6.0.1 rather than 6.0.0 — two of the nine only land in the later version, so stopping at 6.0.0 leaves the arbitrary-SPL issue open. Then Kafka Connect to 2.2.7, Talos to 1.0.3, On-Call to 1.0.43.

While the upgrades are queued, the cheapest compensating control is an audit of who actually holds the admin and power Splunk roles, and specifically which service accounts and agent integrations hold them. Nearly every issue in this batch is gated on a role, and most deployments hand those roles out more generously than the threat model assumes.

Primary sources: Splunk SVD-2026-0808, read 2026-08-25.