CVE-2026-7589: Splunk MCP Integration Path Traversal

CVE-2026-7589 Overview

CVE-2026-7589 is a path traversal vulnerability [CWE-22] in the ghantakiran/splunk-mcp-integration project. The flaw resides in the create_csv_export function within services/csv-export-service/app/api/v1/endpoints/csv_export.py. Attackers can manipulate the job_name argument to traverse outside the intended export directory. The issue is exploitable remotely without authentication or user interaction. The exploit has been publicly disclosed. The project uses continuous delivery with rolling releases, so no fixed version is published. The maintainer was notified through an issue report but has not responded at the time of disclosure.

Critical Impact

Remote, unauthenticated attackers can manipulate the job_name parameter of the CSV Export endpoint to read or write files outside the intended directory, potentially exposing sensitive data on the host running the service.

Affected Products

• ghantakiran splunk-mcp-integration up to commit 0b86b09d5e5adf0433acd43c975951224613a1a6
• Component: CSV Export Service (services/csv-export-service)
• File: app/api/v1/endpoints/csv_export.py

Discovery Timeline

• 2026-05-01 - CVE-2026-7589 published to NVD
• 2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-7589

Vulnerability Analysis

The vulnerability is a path traversal flaw [CWE-22] in the CSV export endpoint of the splunk-mcp-integration project. The create_csv_export function accepts a job_name argument supplied by the client. The function uses this value to construct a filesystem path for the generated CSV without sufficient sanitization. An attacker can submit a job_name value containing traversal sequences such as ../ to escape the intended export directory.

The attack requires no authentication, no privileges, and no user interaction. Exploitation can be performed entirely over the network against any reachable instance of the service. According to the Common Weakness Enumeration mapping, the issue is a classic Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is missing canonicalization and validation of the job_name parameter before it is concatenated or joined with a base directory path. The endpoint trusts client-supplied input as a safe filename component. Without rejecting traversal characters or resolving the final path against an allowlisted root, the service allows the resulting file operation to occur at attacker-chosen locations within the host filesystem.

Attack Vector

An attacker sends a crafted HTTP request to the CSV export endpoint with a job_name value containing relative path segments. The service then writes or names the export artifact at a location outside the export directory. Depending on filesystem permissions of the service process, this can lead to overwriting unrelated files, placing files in sensitive locations, or disclosing path information through error responses. The vulnerability has been publicly disclosed, and a proof of concept is referenced in the GitHub Issue Discussion and the VulDB Vulnerability Report. Refer to the upstream GitHub PoC Repository for source-level details.

Detection Methods for CVE-2026-7589

Indicators of Compromise

• HTTP requests to the CSV export endpoint where the job_name field contains ../, ..\, URL-encoded variants such as %2e%2e%2f, or absolute paths.
• Unexpected files appearing outside the configured CSV export directory on hosts running the service.
• Web server or application logs showing 5xx responses from create_csv_export correlated with unusual job_name values.

Detection Strategies

• Inspect application logs for create_csv_export invocations and flag any job_name value that fails a strict allowlist of alphanumeric characters, hyphens, and underscores.
• Deploy a web application firewall rule that blocks traversal sequences in JSON or form fields targeting /api/v1/endpoints/csv_export.
• Hunt across filesystem audit logs for write operations originating from the CSV export service process to paths outside the export directory.

Monitoring Recommendations

• Forward CSV export service access logs to a centralized analytics pipeline and alert on anomalous job_name lengths or character classes.
• Monitor file integrity on directories adjacent to the export root, including configuration and credential paths.
• Track outbound 4xx or 5xx response spikes from the export endpoint, which often accompany traversal probing.

How to Mitigate CVE-2026-7589

Immediate Actions Required

• Restrict network exposure of the splunk-mcp-integration CSV export endpoint to trusted internal networks only.
• Place the service behind an authenticated reverse proxy and add input filtering for the job_name parameter.
• Run the service as a low-privilege user in a container or chroot to limit the blast radius of successful traversal.

Patch Information

No official patch is available. The project uses continuous delivery with rolling releases, and the maintainer has not responded to the issue report at the time of publication. Operators should track the GitHub Issue Discussion and the upstream GitHub PoC Repository for fix commits. As an interim measure, organizations running the affected commit 0b86b09d5e5adf0433acd43c975951224613a1a6 or earlier should apply a local code change to validate job_name against an allowlist and resolve the final path against the export root.

Workarounds

• Validate job_name server-side with a strict regular expression such as ^[A-Za-z0-9_-]{1,64}$ and reject all other input.
• Resolve the constructed export path with os.path.realpath and verify it begins with the canonical export directory before writing.
• Apply mandatory access controls such as AppArmor or SELinux profiles that confine the service to its export directory.

# Configuration example: nginx reverse proxy filter blocking traversal in job_name
location /api/v1/endpoints/csv_export {
    if ($request_body ~* "\.\.(/|\\|%2f|%5c)") {
        return 400;
    }
    proxy_pass http://splunk_mcp_backend;
}