/Vulnerability Library

Splunk Enterprise Patroni REST API - Missing Authentication RCE

CVE-2026-76268
Early Release

Description

Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 expose the Patroni REST API (PostgreSQL sidecar) on SHC members without authentication. An unauthenticated attacker can PATCH /config to set a malicious archive_command and POST /restart to trigger it, achieving remote code execution with the privileges of the PostgreSQL process via the classic Patroni RCE chain.

Severity

Critical

CVSS Score

9.8

Exploit Probability

0%

Affected Product

splunk_enterprise

Published Date

October 15, 2026

Template Author

dhiyaneshdk

CVE-2026-76268.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-76268
CWE ID:
cwe-306

References

https://advisory.splunk.com/advisories/SVD-2026-1001https://pocbit.org/pocs/cve-2026-76268

Remediation Steps

Upgrade Splunk Enterprise to version 10.2.7 or 10.4.3 or later.