CVE-2026-76286

Executive Summary

CVE-2026-76286 is a server-side request forgery (SSRF) class vulnerability in Splunk MCP Server versions below 1.2.1. When a user with the mcp_tool_execute capability runs a custom API tool, the server transmits that user's Splunk platform authentication token to the URL configured within the tool definition. If the tool was configured by another user who controls the destination URL, the recipient can capture the bearer token and subsequently access Splunk data and perform actions with the victim user's privileges. Splunk Enterprise deployments that have enabled the MCP Server and permit users to define or share custom API tools are affected.

Technical Analysis

The vulnerability is rooted in credential handling logic within the Splunk MCP Server's custom API tool execution path. As described by the CNA, the tool execution routine performs an outbound HTTP request to a URL supplied as part of the tool's configuration. The defect is that this outbound request is composed with the executing user's Splunk platform authentication token attached, rather than a scoped, least-privilege credential or an unauthenticated call. This maps to CWE-918 (Server-Side Request Forgery) because the server is coerced into issuing a request to an attacker-controlled destination using its trusted network position and, critically, while carrying the victim's credential material.

Two distinct authorization contexts are conflated here: the identity of the user who configured the tool versus the identity of the user who runs it. The NVD description states that successful exploitation requires a user holding a role containing the mcp_tool_execute capability to run a custom API tool configured by another user. That asymmetry is the core flaw — the recipient of the token is the URL owner, while the token belongs to the runner. Because API tokens in Splunk are typically long-lived bearer credentials inherited from the executing session, capturing one yields a durable, replayable authentication primitive rather than a single-use artifact.

No function names, class names, endpoints, or parameter identifiers beyond mcp_tool_execute are disclosed in the NVD description or CNA title. The precise HTTP header in which the token is transmitted, the token format, and the tool configuration schema are not specified in the supplied data and should not be assumed. Analysis is therefore confined to the confirmed behavioral fact: the executing user's authentication token is forwarded to a tool-configured URL.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class, the stated precondition (custom API tool configured by another user, executed by a user with mcp_tool_execute), and the CWE-918 classification.

1. Reconnaissance / target identification. An attacker with the ability to create or edit custom API tools within Splunk MCP Server configures a tool whose destination URL points to infrastructure they control (e.g., a collaborator or webhook endpoint). Publishing this tool makes it available for other users to invoke.

2. Triggering the flaw. A second user who holds a role containing the mcp_tool_execute capability invokes the attacker-configured tool. The server performs the outbound request defined by the tool and — due to the flaw — includes the executing user's Splunk platform authentication token in that request.

3. Payload / execution at the vulnerability-class level. This is a server-side request forgery where the outbound request carries sensitive credential headers to an untrusted host. No payload injection is required by the attacker beyond hosting the receiving endpoint and, optionally, a valid TLS certificate and innocuous HTTP response so the tool execution proceeds without user-visible error.

4. Post-exploitation impact. The attacker captures the token from the inbound request and replays it. Per the CNA, they can then "access data and perform actions as the user who ran the tool." Because the capability-gated user is the token owner, the attacker inherits whatever data access and permissions that user's Splunk role grants — including search, index access, and any administrative actions exposed to that role.

Impact Assessment

The CVSS 3.1 base score is 5.3 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L. Interpretation of the subscores:

• Confidentiality: High — the disclosed artifact is an authentication token granting access to data the victim user can read. Token replay can expose indexed data, saved searches, and configuration.
• Integrity: Low / Availability: Low — the token permits actions as the victim user, but the mutation scope is bounded by the victim's role rather than being unrestricted administrative control.
• Attack Vector: Network — the outbound request traverses the network to the attacker-controlled URL.
• Attack Complexity: High — exploitation depends on an attacker configuring a tool, a separate capable user invoking it, and the receiving endpoint being reachable.
• Privileges Required: High — the actor creating the malicious tool requires the ability to author custom tools, and the victim must hold mcp_tool_execute.
• User Interaction: Required — a targeted user must run the attacker-configured tool.

Blast radius is scoped to the victim user's effective permissions. In environments where MCP Server tools are executed by privileged operators or service accounts, the practical impact can be severe despite the Medium score. This CVE is not listed in CISA KEV and EPSS is 0.00174 (6.2nd percentile), indicating low modeled exploitation likelihood in the wild at present.

Detection Guidance

Sigma Rule

title: Splunk MCP Server Custom Tool Token Exfiltration via SSRF
id: 8f3c1a92-4d21-4b77-9c0e-2a6b5e11f4d0
status: experimental
description: Detects outbound API tool executions by Splunk MCP Server that may forward a user authentication token to an attacker-controlled URL (CVE-2026-76286).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76286
author: valtersit.com
date: 2026/01/01
logsource:
  product: splunk
  service: mcp_server
detection:
  selection_event:
    event.action:
      - 'mcp_tool_execute'
      - 'custom_tool_execute'
  selection_url:
    destination.hostname|re:
      - '.*(trycloudflare|ngrok|burp|interactsh|oast|webhook).*'
  condition: selection_event and selection_url
fields:
  - user
  - destination.hostname
  - tool.name
falsepositives:
  - Legitimate use of webhook or tunneling services for approved integrations
level: medium

YARA Rule

rule CVE_2026_76286_Splunk_MCP_Token_SSRF
{
    meta:
        description = "Detects Splunk MCP Server custom tool definitions or logs referencing outbound token propagation (CVE-2026-76286)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76286"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $t1 = "mcp_tool_execute" ascii nocase
        $t2 = "custom_tool" ascii nocase
        $t3 = "Authorization" ascii nocase
        $b1 = "Bearer " ascii nocase
        $u1 = "http://" ascii nocase
        $u2 = "https://" ascii nocase
        $p1 = "mcp" ascii nocase

    condition:
        filesize < 2MB and
        (2 of ($t*) and any of ($u*)) and any of ($b1) and $p1
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-76286 Splunk MCP Server Custom Tool Token Exfiltration Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Authorization"; nocase; http.header; content:"Bearer"; nocase; http.user_agent; content:"MCP"; nocase; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-76286; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76286; classtype:attempted-user; sid:202676286; rev:1;)

Elastic Detection

sequence by user.id with maxspan=2m
  [any where event.action in ("mcp_tool_execute", "custom_tool_execute") and
     event.category == "process"]
  [network where destination.port in (80, 443, 8080, 8443) and
     network.direction == "egress" and
     not destination.domain in ("*.splunk.com", "*.splunkcloud.com")]

Splunk SPL Query

index=splunk_mcp OR index=_internal source=*mcp_server* action IN ("mcp_tool_execute","custom_tool_execute")
| eval dest_host=coalesce(destination_host, url_host, tool_url)
| lookup threat_intel_domains domain AS dest_host OUTPUT is_malicious
| where is_malicious=1 OR match(dest_host,"(?i)(ngrok|interactsh|oast|burp|webhook|trycloudflare)")
| stats count min(_time) as first_seen max(_time) as last_seen values(tool_name) as tools by src_user, dest_host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="splunk,mcp,ssrf,">
  <rule id="100762" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">mcp_tool_execute|custom_tool_execute</field>
    <field name="destination.hostname" type="pcre2">(?i)(ngrok|interactsh|oast|burp|webhook|trycloudflare)</field>
    <description>CVE-2026-76286: Possible Splunk MCP Server custom tool token exfiltration to suspicious host</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Upgrade Splunk MCP Server to version 1.2.1 or later, which the CNA states resolves the issue. Note that no tracked patch source currently corroborates availability; verify the fixed version directly with Splunk before relying on it.
   • Until upgrade is possible, restrict authoring of custom API tools to trusted administrators only, so untrusted users cannot define the destination URL that receives the token.
   • Tighten role assignments: audit which roles contain mcp_tool_execute and remove it from any principal that does not strictly require custom tool execution.
   • Restrict outbound egress from MCP Server hosts to an allowlist of approved destinations to blunt SSRF delivery to attacker-controlled endpoints.
   • Treat any Splunk authentication token that may have transited an unverified tool URL as compromised and rotate it.

2. Patch/upgrade steps.

   • Confirm the MCP Server version in use and upgrade to 1.2.1 or later per the Splunk documentation referenced in the advisory.
   • After upgrade, re-review all existing custom API tool definitions, removing or reconfiguring any whose URL was supplied by an untrusted party.
   • Rotate authentication tokens for users who executed custom tools during the exposure window.

3. Long-term hardening.

   • Adopt a policy that tool execution must never forward the executing user's ambient credential to externally defined endpoints; require scoped, explicitly consented credentials for outbound calls.
   • Enforce least-privilege role design for the MCP Server and monitor capability grants via change management.
   • Deploy egress filtering and DNS logging for MCP Server hosts, and alert on tool executions targeting newly observed or low-reputation domains.
   • Include MCP Server and custom tool configuration changes in tamper-evident audit logging and periodic review.

References

• NVD — CVE-2026-76286: https://nvd.nist.gov/vuln/detail/CVE-2026-76286
• Splunk documentation — Configure the Splunk MCP Server: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/1.2/configure-the-splunk-mcp-server
• Splunk documentation — Managing custom tools in Splunk MCP Server: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/1.2/managing-custom-tools-in-splunk-mcp-server
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html

No exploit-in-the-wild evidence, threat actor campaign attribution, or public PoC was identified for this CVE at the time of writing. It is not listed in CISA KEV, and no Nuclei template or exploit code was observed.