CVE-2026-76268
Splunk Enterprise Patroni REST API missing authentication RCE
Splunk scores CVE-2026-76268 CVSS 3.1 9.8 (Critical). An unauthenticated user with network access to the Patroni REST API on a search head cluster member can run operating system commands. Affects Splunk Enterprise 10.2.0 to 10.2.6 and 10.4.0 to 10.4.2. Fixed in 10.2.7 and 10.4.3 on 7 October 2026. Third-party PoC claimed. Not in CISA KEV.
- CVSS
- 9.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Class
- RCE
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Splunk
- Products
- Splunk Enterprise
- Affected
- Splunk Enterprise 10.2.0 before 10.2.7 and 10.4.0 before 10.4.3, on search head cluster members. Splunk Enterprise 10.0.x and 9.4.x are not affected.
- Fixed
- Splunk Enterprise 10.2.7 and 10.4.3, published 7 October 2026. Workaround per Splunk: disable the PostgreSQL sidecar if Edge Processor, OpAmp and SPL2 pipelines are not used.
- CWE
- CWE-306
- Published
- 7 Oct 2026
- Updated
- 15 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-76268 is a missing authentication flaw (CWE-306) in the Patroni REST API of Splunk Enterprise. Patroni runs in the PostgreSQL sidecar on search head cluster members. The API does not require authentication for critical configuration operations.
Splunk published advisory SVD-2026-1001 on 7 October 2026. Splunk scores it CVSS 3.1 9.8 (Critical). NVD lists the same score and has analyzed the record.
An unauthenticated user with network access to the Patroni API can run attacker-controlled operating system commands. Splunk says Enterprise 10.0.x and 9.4.x are not affected.
Fixed versions are 10.2.7 and 10.4.3. Splunk's workaround is to disable the PostgreSQL sidecar. That is only safe if you do not use Edge Processor, OpAmp or SPL2 pipelines. A restart is required.
Splunk credits Gabriel Nitu of Splunk, an internal finder. The CVE is not in the CISA KEV catalog. CISA's SSVC entry on NVD records exploitation as none. No exploitation in the wild is reported.
A GitHub account named murrez published a repository on 13 October 2026 that claims a PoC for this CVE. It describes a check tool and a mass exploitation tool. ThreatWire did not run or review it. The account is not the Splunk credited finder. The PoC link field points to it; the URL is not repeated here.