Splunk Enterprise: unauthenticated Patroni REST API flaw allows OS command execution on search head cluster members (CVE-2026-76268)
Severity: critical · Patch status: patched · Since 2026-10-07 · CVE-2026-101767, CVE-2026-104935, CVE-2026-109618, CVE-2026-109619, CVE-2026-76268
Splunk disclosed SVD-2026-1001 on 2026-10-07: CVE-2026-76268, a critical (CVSS 9.8) missing-authentication flaw (CWE-306) in the Patroni REST API on Splunk Enterprise search head cluster members. An unauthenticated attacker with network access to the API can abuse unauthenticated configuration operations to execute attacker-controlled OS commands, with high impact to confidentiality, integrity, and availability; no user interaction or credentials required, and internal network access suffices. Affected: Splunk Enterprise 10.4.0–10.4.2 and 10.2.0–10.2.6 (10.0.x and 9.4.x not affected). No active exploitation reported, but a public proof-of-concept repository exists. Fixed in 10.4.3 and 10.2.7; workaround disables the PostgreSQL sidecar in server.conf for those not using Edge Processor, OpAmp, or SPL2 pipelines. Horizon3 released a NodeZero Rapid Response validation test.
What to do
- Upgrade search head cluster members to Splunk Enterprise 10.4.3+ (10.4 branch) or 10.2.7+ (10.2 branch) immediately
- If unable to upgrade and not using Edge Processor, OpAmp, or SPL2 pipelines, set [postgres] disabled = true in $SPLUNK_HOME/etc/system/local/server.conf and restart Splunk
- Restrict network access to the Patroni REST API on search head cluster members (firewall/segmentation), since internal access is enough to exploit
- Validate exposure and verify remediation using Horizon3's NodeZero Rapid Response test or equivalent checks
- Monitor Splunk advisories and logs for signs of exploitation attempts against the API
Fixed versions
- Splunk Enterprise 10.4.3+
- Splunk Enterprise 10.2.7+
Sources
All live incidents on Threat Watch
