CVE

CVE-2026-76268

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

splunk enterprise

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalMisconfiguration~10 seconds

Splunk Enterprise Patroni REST API - Missing Authentication RCE

Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 expose the Patroni REST API (PostgreSQL sidecar) on SHC members without authentication. An unauthenticated attacker can PATCH /config to set a malicious archive_command and POST /restart to trigger it, achieving remote code execution with the privileges of the PostgreSQL process via the classic Patroni RCE chain. References: https://advisory.splunk.com/advisories/SVD-2026-1001 https://pocbit.org/pocs/cve-2026-76268 Remediation: Upgrade Splunk Enterprise to version 10.2.7 or 10.4.3 or later.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: splunk enterprise

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →