All vulnerabilities
CVE-2026-76268

Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise

Splunk Splunk EnterpriseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei
Exploit odds (EPSS)1.59%Chance of exploitation activity in the next 30 days, higher than 75% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.4.3Also 10.2.7CVE List
Published7 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 7 Oct 2026, 20:46 UTCPublishedCVE List
  2. 22 Oct 2026, 20:25 UTCFirst reportHorizon3.ai
  3. 23 Oct 2026, 13:32 UTCExploit code publicGitHub proof-of-concept repositories

Public exploit code and templates 1

  • Scanner templateSplunk Enterprise Patroni REST API - Missing Authentication RCENuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 3

3 outlets mention it. Reports are not confirmation; each links to its source.

Description

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.

Splunk Enterprise versions 10.0.x and 9.4.x are not affected.

Text from CVE List

Affected versions 2

  • Splunk Enterpriseaffected: 10.4 before 10.4.3CVE List
  • Splunk Enterpriseaffected: 10.2 before 10.2.7CVE List

References 1