CVE-2025-20381 SPL commands allowlist controls bypass in Splunk MCP Server app through "run_splunk_query" MCP tool
Attackers can bypass SPL command allowlist controls in Splunk MCP Server by embedding sub-searches, enabling unauthorized actions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-20381?
CVE-2025-20381 is a medium-severity vulnerability in Splunk MCP Server, published on 3 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Splunk MCP Server app versions below 0.2.4, a user with access to the "run_splunk_query" Model Context Protocol (MCP) tool could bypass the SPL command allowlist controls in MCP by embedding SPL commands as sub-searches, leading to unauthorized actions beyond the intended MCP restrictions.
Weakness: CWE-863
Which versions are affected by CVE-2025-20381?
How do I fix CVE-2025-20381?
No fix has been published for CVE-2025-20381 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-20381 being exploited?
There is no known exploitation of CVE-2025-20381 in the wild and no public exploit code.
Sources
Also known as GHSA-qf9v-6rq4-3w87.