Splunk Issues Urgent Fixes for RCE and Clear-Text Token Leaks

Splunk published advisories for two serious vulnerabilities: CVE-2026-20204 allows a low-privileged user to upload a malicious file to $SPLUNK_HOME/var/run/splunk/apptemp and potentially achieve remote code execution on hosts with Splunk Web enabled, and CVE-2026-20205 in the Splunk MCP Server app can expose session and authorization tokens in clear text within internal logs. Administrators are urged to apply specified patches/updates (Splunk Enterprise, Splunk Cloud Platform, and MCP Server app), consider disabling Splunk Web as a temporary mitigation for the RCE issue, and restrict access to internal indexes to administrator-level roles.