Splunk Enterprise Patroni API flaw allows unauthenticated commands
Original title: CVE-2026-76268 | Splunk Enterprise Patroni REST API Missing Authentication Vulnerability
Splunk rates CVE-2026-76268 9.8 and reports no active exploitation; a public repository offers claimed PoC code.
CVE-2026-76268 is a missing-authentication flaw in the Patroni REST API on Splunk Enterprise search head cluster members. An unauthenticated attacker who can reach the interface could run operating-system commands. Splunk fixed the 10.4 and 10.2 branches and says 10.0.x and 9.4.x are not affected. Horizon3 says a public repository contains code presented as a proof of concept and offers a NodeZero test.
Unconfirmed: Splunk's advisory does not report active exploitation, and the public code is only presented as a proof of concept.
- Affected ranges are 10.4.0 through 10.4.2 and 10.2.0 through 10.2.6.
- Fixes are 10.4.3 or later and 10.2.7 or later.
- Splunk published advisory SVD-2026-1001 on October 7, 2026.
- If Edge Processor, OpAmp, and SPL2 pipelines are unused, disable the PostgreSQL sidecar.
- Internet exposure is not required for exploitation.
Impact: Unauthenticated operating-system command execution on a cluster member
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Enterprise | 10.4.0 through 10.4.2 | 10.4.3 or later |
| Splunk Enterprise | 10.2.0 through 10.2.6 | 10.2.7 or later |
- 1.Upgrade Splunk Enterprise to 10.4.3 or later, or 10.2.7 or later.
- 2.If those features are unused, set postgres disabled to true and restart.
- 3.Use NodeZero Rapid Response to check whether the interface is exploitable.
- CVEs
- CVE-2026-76268
- Vendors
- Splunk
- Products
- Splunk Enterprise
- Organizations
- Horizon3.ai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76268 | Unauthenticated command execution via Splunk Patroni API | 9.8 | 5% | PoC ×2 |
From the original article
2 min read at horizon3.ai
Horizon3. ai's NodeZero Rapid Response test helps security teams validate exposure to CVE-2026-76268, a critical Splunk Enterprise vulnerability that could allow unauthenticated attackers with network access to execute operating-system commands.
By Horizon3 · horizon3.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.