CVE-2026-76268
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
Updated
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 5.7% (93rd pct)
- CISA KEV
- Not listed
- Published
- 2026-10-07
- Weakness
- CWE-306
Description
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.
Key Findings
as of 2026-11-12- Its current EPSS score (5.7%) is higher than that of 18% of CISA KEV entries.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CVSS calculator Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Splunk | Splunk Splunk Enterprise | 10.4 to <10.4.3 10.2 to <10.2.7 |
References
1 linksOther references
Record Details
- Published
- 2026-10-07
- Last updated
- 2026-10-21
- Assigner (CNA)
- cisco
- Credited to
- Gabriel Nitu, Splunk; Ofir Alkoby, Security Researcher, a.security
More from Splunk
Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.