CVE-2026-76268: Splunk Enterprise Patroni REST API Unauthenticated RCE

Overview

Splunk has disclosed CVE-2026-76268, a maximum-impact vulnerability in the Patroni REST API used by Splunk Enterprise search head cluster members. Rated CVSS 9.8 (critical), the flaw lets an unauthenticated attacker with network access to the Patroni REST API execute attacker-controlled operating-system commands on the underlying host — no credentials, no user interaction, and no prior access required.

The vulnerability was disclosed October 7, 2026 as part of Splunk's broader advisory SVD-2026-1001, which patched 22 vulnerabilities across Splunk Enterprise's supported branches. CVE-2026-76268 is the most severe of the batch.

Technical Details

How It Works

Patroni is the open-source PostgreSQL high-availability and cluster-management tool that Splunk bundles to run and coordinate the PostgreSQL sidecar backing search head clustering. Patroni exposes a REST API so cluster members can check leader status, trigger failovers, and push configuration changes to the PostgreSQL instance each node manages.

In affected Splunk Enterprise releases, that REST API does not require authentication for critical configuration operations. An attacker who can simply reach the Patroni REST API port over the network — no Splunk account, no session token, no interaction from a legitimate user — can submit requests that Patroni treats as trusted administrative instructions. Because Patroni configuration changes can influence how the managed PostgreSQL process (and the broader set of external processes and data-collection agents Splunk coordinates around it) is started and run, an attacker can smuggle in attacker-controlled operating-system commands that execute with the privileges of the Splunk/Patroni service account on the host. The result is remote code execution without ever touching Splunk Web or authenticating to Splunk itself.

Impact Assessment

Who Is At Risk

• Splunk Enterprise deployments running search head clustering with the Patroni-managed PostgreSQL sidecar enabled
• Environments where the Patroni REST API port is reachable from anywhere beyond a tightly controlled, cluster-internal management network
• Specifically, Splunk Enterprise 10.4.x before 10.4.3 and 10.2.x before 10.2.7 — the 10.0.x and 9.4.x branches are not affected by this particular CVE, though Splunk shipped 10.0.10 and 9.4.15 the same day for other issues in the same advisory batch

Potential Attack Chains

1. Network reachability — Attacker identifies a search head cluster member with the Patroni REST API port exposed beyond the intended management network
2. Unauthenticated command submission — Attacker sends crafted requests to the Patroni REST API without presenting any credentials
3. OS command execution — Patroni processes the request as a trusted configuration operation, resulting in attacker-controlled operating-system commands executing on the host with the Splunk/Patroni service account's privileges
4. Full search head compromise / lateral movement — With host-level code execution, the attacker can pivot into indexed log data, pull credentials or forwarder configurations, and move laterally across the broader Splunk deployment

Mitigation

Immediate Actions

• Upgrade to Splunk Enterprise 10.4.3 or 10.2.7 (or later) immediately — this is the only complete fix
• Interim mitigation if upgrading is not immediately possible: disable the PostgreSQL sidecar by setting disabled = true in the [postgres] stanza of $SPLUNK_HOME/etc/system/local/server.conf, then restart Splunk Enterprise — but only where Edge Processor, OpAmp, or SPL2 data pipelines are not in use, since those features depend on the sidecar
• Restrict network access to the Patroni REST API port to cluster-internal management hosts only, as a defence-in-depth measure alongside patching

Detection Opportunities

• Monitor for unexpected process spawns originating from the Splunk/Patroni service account on search head cluster hosts
• Review web/proxy and network flow logs for unauthenticated requests reaching the Patroni REST API port, particularly from sources outside the expected cluster-management subnet
• Audit server.conf and Patroni configuration state for unexpected changes around the disclosure window

Defence-in-Depth

• Segment the search head cluster's management plane (including the Patroni REST API) from general-purpose and user-facing network segments
• Run the Splunk/Patroni service account with least privilege, limiting the blast radius of any command execution
• Continuously monitor Splunk infrastructure hosts for anomalous OS command execution, independent of Splunk's own internal logging

Discovery & Disclosure

CVE-2026-76268 was disclosed by Splunk on October 7, 2026 (published via NVD October 8, 2026) as part of security advisory SVD-2026-1001, alongside 21 other vulnerabilities across Splunk Enterprise's supported branches. Splunk credits researcher Gabriel Nitu with discovering the issue. As of publication, there is no public proof-of-concept exploit and the flaw is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Given the critical CVSS 9.8 score and the complete absence of any authentication requirement, treat patching as urgent regardless of confirmed in-the-wild exploitation.

References

• NVD — CVE-2026-76268
• Splunk Security Advisory SVD-2026-1001
• Splunk Patches Critical 9.8 Flaw Allowing Unauthenticated Remote Command Execution — Cybersecurity News