Splunk Enterprise Patroni flaw CVE-2026-76268 allows unauthenticated RCE

What happened

Splunk published advisory SVD-2026-1001 on 7 October 2026. It fixes several Splunk Enterprise flaws. The most severe is CVE-2026-76268, rated Critical.

The flaw is in the Patroni REST API. Patroni manages the PostgreSQL sidecar on search head cluster members. The API does not require authentication for critical configuration operations.

Splunk credits Gabriel Nitu of Splunk as the finder. The flaw was found internally.

Who is affected

Splunk Enterprise 10.2.0 to 10.2.6 and 10.4.0 to 10.4.2 are affected. Splunk Enterprise 10.0.x and 9.4.x are not affected by this CVE.

The advisory describes search head cluster members. An attacker needs network access to the Patroni API. Splunk does not say how many deployments expose that API. Treat any reachable cluster member as exposed until checked.

What is confirmed

Splunk scores the flaw CVSS 3.1 9.8 (Critical). NVD lists the same score and the weakness CWE-306. An unauthenticated user can run operating system commands on the host.

The fixes are Splunk Enterprise 10.2.7 and 10.4.3. Splunk offers a workaround. Disable the PostgreSQL sidecar if you do not use Edge Processor, OpAmp or SPL2 pipelines. Restart Splunk to apply it.

The CVE is not in the CISA KEV catalog. CISA's SSVC entry on NVD records exploitation as none. Tenable lists an exploit as available for its scanner plugin.

A GitHub account named murrez published a repository on 13 October 2026 claiming a PoC for this CVE. It describes a check tool and a mass exploitation tool. ThreatWire did not run or review it. The account is not the credited finder.

What is not confirmed

No source reports exploitation in the wild. ThreatWire cannot verify that the third-party PoC works. It also cannot say how many Splunk clusters expose the Patroni API to untrusted networks.

ThreatWire found no coverage from established news outlets at the time of writing. Splunk does not state the privilege level of the resulting commands.

What to do

Upgrade Splunk Enterprise to 10.2.7 or 10.4.3. If you cannot, apply Splunk's sidecar workaround where it is safe for your pipelines.

Restrict network access to search head cluster members to trusted hosts. Review those hosts for unexpected configuration changes or processes. A public PoC makes scanning more likely. Prioritize clusters reachable from outside your management network.

Sources: the Splunk advisory SVD-2026-1001, NVD, CVE.org, Splunk documentation and Tenable. Links are in the references list.