CVE-2026-76268 | Splunk Enterprise Patroni REST API Missing Authentication Vulnerability
CVE-2026-76268 | Splunk Enterprise Patroni REST API Missing Authentication Vulnerability
CVE-2026-76268 is a critical missing authentication vulnerability in Splunk Enterprise. An unauthenticated attacker with network access to the Patroni REST API on a search head cluster member could execute attacker-controlled operating-system commands. Splunk rates the vulnerability 9.8 (Critical) under CVSS v3.1. Its advisory does not report active exploitation. A public repository contains code presented as a proof of concept for this CVE.
The vulnerability exists because the Patroni REST API does not require authentication for critical configuration operations. An attacker who can reach the affected interface on a search head cluster member could abuse those operations to execute operating-system commands. The weakness is identified as CWE-306, Missing Authentication for Critical Function. The attack vector involves network access to the affected Patroni REST API, requiring no credentials or existing privileges, and no user interaction. The impact is operating-system command execution, with potentially high impact to confidentiality, integrity, and availability. Internet exposure is not required, as an attacker with internal network access to the affected interface could also exploit the vulnerability.
Affected versions include Splunk Enterprise 10.4.0 through 10.4.2, and Splunk Enterprise 10.2.0 through 10.2.6. Splunk Enterprise 10.0.x and 9.4.x are not affected by this CVE. Fixed versions are Splunk Enterprise 10.4.3 or later in the 10.4 branch, and Splunk Enterprise 10.2.7 or later in the 10.2 branch.
If immediate upgrade is not possible and Edge Processor, OpAmp, or SPL2 data pipelines are not used, Splunk recommends disabling the PostgreSQL sidecar. This can be done by setting disabled = true under the [postgres] section in $SPLUNK_HOME/etc/system/local/server.conf. Splunk Enterprise must be restarted to apply the change. This workaround should only be used when the listed features are unused.
The vulnerability was first disclosed on October 7, 2026, when Splunk published advisory SVD-2026-1001, identifying the vulnerability and fixed versions 10.4.3 and 10.2.7. On the same day, October 7, 2026, the CVE record was published.
For more details, check out the full article here: Read full article 🚀