Splunk Enterprise: Unauthenticated command execution in Patroni REST API

Summary

Splunk Enterprise search head cluster (SHC) members in the 10.4 and 10.2 branches expose a Patroni REST API that does not require authentication for critical configuration operations. An unauthenticated attacker with network access to this API can execute operating-system commands on the affected host. Standalone instances are not described as affected, and versions 10.0.x and 9.4.x are not affected.

Affected

• Splunk Enterprise 10.4.0 to 10.4.2
• Splunk Enterprise 10.2.0 to 10.2.6
• Relevant only on search head cluster members with the PostgreSQL (Patroni) sidecar enabled
• Not affected: Splunk Enterprise 10.0.x and 9.4.x

Fixed in

• Splunk Enterprise 10.4.3 or later (10.4 branch)
• Splunk Enterprise 10.2.7 or later (10.2 branch)

Workaround

• If you do not use Edge Processor, OpAmp or SPL2 data pipelines, set disabled = true in the [postgres] stanza of $SPLUNK_HOME/etc/system/local/server.conf and restart Splunk Enterprise.
• Restrict network access to the Patroni and etcd ports to SHC peer IP addresses only (general hardening).

Exploitation

• Splunk reports no active exploitation.
• CISA SSVC assessment: Exploitation none, automatable yes, technical impact total.
• Public proof-of-concept code has been reported; it has not been verified by this tracker.

Our recommendation

• Check whether you run a search head cluster and which version (10.2.x or 10.4.x).
• Upgrade to 10.2.7, 10.4.3 or later as a priority.
• If you cannot upgrade immediately, disable the unused [postgres] sidecar and restrict Patroni and etcd access to SHC peers.
• Review logs for unexpected requests to the Patroni API.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  murrez/CVE-2026-76268

Research sources

• Splunk Advisory SVD-2026-1001 advisory.splunk.com
• Horizon3.ai analysis of CVE-2026-76268 horizon3.ai
• CSA Singapore alert AL-2026-145 www.csa.gov.sg
• Cyberpress: Critical Splunk Enterprise vulnerability cyberpress.org
• GitHub: public PoC repository (unverified) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:36.