Splunk Enterprise: Hard-coded cryptographic key in PostgreSQL sidecar

Summary

Search head cluster members of Splunk Enterprise below 10.4.4 and 10.2.8 contain a flaw in the PostgreSQL sidecar service. The service derives the database superuser password from the search head cluster identifier, which appears in search job logs. A user without the admin or power role who can obtain this identifier can derive the password and run operating system commands as the account running Splunk Enterprise. The CVE title refers to a hard-coded key, but the advisory description describes a derived password; standalone instances are not described as affected.

Affected

• Splunk Enterprise 10.4.0 to 10.4.3
• Splunk Enterprise 10.2.0 to 10.2.7
• Unknown: whether 10.0.x and 9.4.x are affected. Check the vendor advisory SVD-2026-1007.

Fixed in

• Splunk Enterprise 10.4.4
• Splunk Enterprise 10.2.8
• Splunk lists 10.0.11 and 9.4.16 as fixed releases for other CVEs in the same advisory; for this CVE, check the vendor advisory.

Workaround

• If an immediate upgrade is not possible, set [postgres] disabled = true in server.conf and restart Splunk Enterprise.
• Do not apply this workaround if Edge Processor, OpAmp or SPL2 data pipelines are used on the instance, because they will break.
• Restrict which users can read search job logs.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Sources list the status as not exploited and no public proof of concept was found; these are aggregator sources and should be rechecked.

Our recommendation

• Identify search head cluster members running affected versions.
• Upgrade to 10.4.4 or 10.2.8 or later as soon as possible.
• If upgrading is not possible, apply the sidecar workaround after checking whether Edge Processor, OpAmp or SPL2 pipelines are in use.
• Restrict access to search job logs and monitor for unusual operating system commands run by the Splunk service account.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk Advisory SVD-2026-1007 advisory.splunk.com
• OpenCVE CVE-2026-76298 app.opencve.io
• Splunk sidecar configuration settings help.splunk.com
• Securityonline: Splunk vulnerabilities October 2026 securityonline.info
• Strix CVE-2026-76298 www.strix.ai
• The Hacker Wire CVE-2026-76298 www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:04.