Act nowDisclosed

Advisory · CVE-2026-76268

Unauthenticated RCE in Splunk Enterprise via Patroni REST API

Splunk Enterprise search head cluster members expose a Patroni REST API without authentication, letting remote attackers run OS commands. Fixed in 10.4.3 and 10.2.7.

Advisory published October 7, 2026Independent summary
Vendor
Splunk
Product
Splunk Enterprise
Identifier / CWE
CVE-2026-76268
CWE-306
Action timing
Immediate
ELI5

Explain it like I’m five

Part of Splunk's search cluster has a control panel with no login screen. Anyone who can reach it over the network can type in commands that run on the server.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Network reachability

    An unauthenticated user has network access to the Patroni REST API on a Splunk Enterprise search head cluster member.

  2. 02No authentication

    The interface does not require authentication for critical configuration operations.

  3. 03Command execution

    The attacker invokes critical operations that execute attacker-controlled operating-system commands.

What happened

Splunk disclosed CVE-2026-76268 in advisory SVD-2026-1001, rating it Critical with a CVSS base score of 9.8. In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni REST API on a search head cluster member could execute attacker-controlled operating-system commands, because the interface does not require authentication for critical configuration operations. Versions 10.0.x and 9.4.x are not affected.

Splunk’s fix is to upgrade to 10.4.3, 10.2.7, 10.0.10, or 9.4.15 as appropriate. As a mitigation, Splunk says to turn off the PostgreSQL sidecar by setting disabled = true in the [postgres] stanza of server.conf (and restarting) if Edge Processor, OpAmp, or SPL2 data pipelines are not in use.

What to do

  1. Identify Splunk Enterprise search head cluster members running 10.4.0-10.4.2 or 10.2.0-10.2.6.
  2. Upgrade to 10.4.3 or 10.2.7 (or later) per the advisory. Versions 10.0.x and 9.4.x are not affected by this CVE.
  3. If you cannot upgrade immediately and do not use Edge Processor, OpAmp, or SPL2 data pipelines, disable the PostgreSQL sidecar as described in the advisory.
  4. Restrict network access to the Patroni API port on cluster members to trusted hosts.
  5. Review Splunk and OS logs on cluster members for unexpected command execution.

Management note

This is unauthenticated RCE on the SIEM itself, the system your detection depends on. A compromised search head can blind your monitoring while the attacker operates. Patch quickly, and treat any delay as a detection gap, not just a vulnerability.