Vulnerability Intelligence Report
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
CVE-2026-76268
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:0.40%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-306 ↗The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.4 < 10.4.3 (affected), 10.2 < 10.2.7 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.400%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cisco Systems, Inc. · Hosted Service · USA |
| Reserved | 2026-08-19T12:02:03 |
| Published | 2026-10-07T20:46:31 |
| Patch Date | 2026-10-07 |
| Last Updated | 2026-10-09T03:55:28 |
Community Chatter & Buzz