CVE-2025-20381
BaseFortify
Publication date: 2025-12-03
Last updated on: 2025-12-04
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| splunk | mcp_server_app | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Splunk MCP Server app versions below 0.2.4, where a user with access to the "run_splunk_query" Model Context Protocol (MCP) tool can bypass the SPL command allowlist controls by embedding SPL commands as sub-searches. This allows the user to perform unauthorized actions beyond the intended MCP restrictions.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized actions being performed within the Splunk MCP Server app, potentially allowing a user to execute commands that should be restricted. This could result in integrity and availability impacts on the system, as indicated by the CVSS score.