CVE-2026-76268: Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 4.8%
EPSS score, percentile 91.9 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 9.8 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15, or higher.Solution from the CVE record.
CISA has set no required action, because the vulnerability is not in KEV.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- from 10.4 to before 10.4.3
- from 10.2 to before 10.2.7
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-29_0000Z, as of . About the data.
What to do
Solution (from the CVE record)
Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15, or higher.
Workaround (from the CVE record)
Turn off the PostgreSQL sidecar by setting `disabled = true` in the `[postgres]` stanza of `$SPLUNK_HOME/etc/system/local/server.conf` if you do not use Edge Processor, OpAmp, or SPL2 data pipelines. Restart Splunk Enterprise to apply the change. For more information see [Sidecar configuration settings](https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) and [server.conf](https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/configuration-file-reference/10.2.7-configuration-file-reference/server.conf) in the Splunk documentation.
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | from 10.4 to before 10.4.3 |
| Affected | from 10.2 to before 10.2.7 |
Source: CVE List V5 (CVE Program), cve_2026-10-29_0000Z, as of . About the data.
About this vulnerability
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration o…
Summary: CVE record, as of .
- CISA has not added CVE-2026-76268 to its Known Exploited Vulnerabilities (KEV) catalog, as of 28 Oct 2026.
- The CVE record was published on 7 Oct 2026.
- The CVE record carries a CVSS v3.1 base score of 9.8 (Critical), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 4.8% (percentile 91.9), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
- CISA's SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-29_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.
Source: CVE List V5 (CVE Program), cve_2026-10-29_0000Z, as of . About the data.
Weakness
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
Known exploited Splunk vulnerabilities
- CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function Vulnerability