/Vulnerability Library

Splunk Enterprise Patroni REST API - Missing Authentication RCE

CVE-2026-76268
Verified

Description

Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 expose the Patroni REST API (PostgreSQL sidecar) on SHC members without authentication. An unauthenticated attacker can PATCH /config to set a malicious archive_command and POST /restart to trigger it, achieving remote code execution with the privileges of the PostgreSQL process via the classic Patroni RCE chain.

Severity

Critical

CVSS Score

9.8

Exploit Probability

5%

Affected Product

splunk_enterprise

Published Date

October 15, 2026

Template Author

dhiyaneshdk

CVE-2026-76268.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-76268
CWE ID:
cwe-306

References

https://advisory.splunk.com/advisories/SVD-2026-1001https://pocbit.org/pocs/cve-2026-76268

Remediation Steps

Upgrade Splunk Enterprise to version 10.2.7 or 10.4.3 or later.