Splunk MCP Server Sensitive Information Disclosure Vulnerability in Internal Index

A vulnerability exists in the Splunk MCP Server app in versions prior to 1.0.3. Users with access to the Splunk '_internal' index or the 'mcp_tool_admin' capability could view session and authorization tokens in clear text. This issue requires either local access to the log files or administrative access to internal indexes, which is typically reserved for the admin role.

Impact

Exploitation of this vulnerability could lead to unauthorized access to session and authorization tokens, allowing for potential impersonation or unauthorized actions on behalf of the user.

Remediation

Users are advised to upgrade the Splunk MCP Server app to version 1.0.3 or higher.