Critical Splunk Enterprise Vulnerability Lets Unauthenticated Attackers Execute OS Commands

Splunk has addressed a critical vulnerability in Splunk Enterprise that allows unauthenticated attackers to execute operating system commands through the Patroni REST API on a search head cluster member.

This issue, tracked as CVE-2026-76268, has a CVSS v3.1 score of 9.8 and was disclosed in advisory SVD-2026-1001 on October 7, 2026. Successful exploitation requires network access to the affected interface, but does not require credentials or user interaction.

Splunk Enterprise Vulnerability

The vulnerability affects Splunk Enterprise releases in the 10.4 and 10.2 branches before versions 10.4.3 and 10.2.7, respectively. Splunk explicitly states that versions 10.0.x and 9.4.x are not affected by this particular issue; however, those branches received updates addressing other vulnerabilities during the same release cycle.

The security flaw arises from missing authentication for critical configuration operations exposed through the Patroni Representational State Transfer (REST) API.

An attacker who can access this interface on a vulnerable search head cluster member could exploit these operations to execute attacker-controlled commands. Splunk classifies this issue as CWE-306, “Missing Authentication for Critical Function,” and tracks it internally under bug identifier VULN-79185.

The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-accessible attack with low complexity, no required privileges, and no user interaction.

The assessment assigns a high impact to confidentiality, integrity, and availability. However, the advisory does not specify the operating system privileges available to executed commands, disclose an exploit payload, or report any active exploitation.

Splunk credits Gabriel Nitu of Splunk with identifying the vulnerability. The disclosure focuses on the exposed configuration interface rather than an authenticated user workflow, making network reachability a critical factor when assessing deployment exposure.

Splunk’s documentation identifies PostgreSQL as its storage sidecar, controlled through the [postgres] stanza in the server.conf file. Splunk Enterprise enables the sidecar by default, with the setting `disabled = false`. However, this default does not automatically lead to exploitability; the advisory specifically requires access to the Patroni API on a search head cluster member.

Administrators should avoid assuming that Patroni always listens on TCP port 8008. While Splunk documents this port in an example configuration, its IPC Broker assigns a random available port when a specific service address is not configured. Therefore, exposure reviews must examine actual service bindings and configurations instead of relying solely on a fixed-port check.

Organizations running affected releases should upgrade to Splunk Enterprise versions 10.4.3 or 10.2.7, or any later release in the corresponding branch.

These versions address CVE-2026-76268 as part of Splunk’s broader September/October security updates. The overall advisory also lists fixes in versions 10.0.10 and 9.4.15 for other issues; those branches remain unaffected by this Patroni vulnerability.

For deployments that do not use Edge Processor, OpAmp, or SPL2 data pipelines, Splunk provides a workaround: set `disabled = true` under the [postgres] stanza in $SPLUNK_HOME/etc/system/local/server.conf.

Administrators must restart Splunk Enterprise for the change to take effect. Since this workaround depends on feature usage, organizations should verify their dependencies before disabling the PostgreSQL sidecar rather than applying the change universally.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.