CVE-2026-76268

Received Received - Intake

Unauthenticated Command Injection in Splunk Enterprise

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76268

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.3 and 10.2.7. An unauthenticated user with network access to the Patroni REST API on a search head cluster member could execute attacker-controlled operating-system commands. The issue occurs because the API does not require authentication for critical configuration operations.

Detection Guidance

To detect this vulnerability, check if your Splunk Enterprise version is below 10.4.3 or 10.2.7. Run the command 'splunk version' on the search head cluster member to verify the version. If the version is affected, inspect network access to the Patroni REST API endpoint for unauthenticated requests.

Impact Analysis

An attacker could exploit this to run arbitrary commands on the system hosting the Splunk Enterprise search head cluster member. This could lead to full system compromise, data theft, or disruption of services. The impact is severe due to the lack of required authentication.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance risks include fines, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Splunk Enterprise to version 10.4.3 or 10.2.7 or later immediately. If upgrading is not possible, restrict network access to the Patroni REST API endpoint to trusted sources only and ensure authentication is enforced for critical operations.

Hi! I’m here to help you understand CVE-2026-76268. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70