{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76268", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2026-08-19T12:02:03.620Z", "datePublished": "2026-10-07T20:46:31.281Z", "dateUpdated": "2026-10-07T20:46:31.281Z"}, "containers": {"cna": {"affected": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"version": "10.4", "status": "affected", "versionType": "custom", "lessThan": "10.4.3"}, {"version": "10.2", "status": "affected", "versionType": "custom", "lessThan": "10.2.7"}], "modules": ["REST API"]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/markdown", "value": "In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see [Sidecar configuration settings](https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.\n\nSplunk Enterprise versions 10.0.x and 9.4.x are not affected."}], "value": "In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.\n\nSplunk Enterprise versions 10.0.x and 9.4.x are not affected."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-1001"}], "title": "Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise", "datePublic": "2026-10-07T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-306", "description": "The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources."}]}], "source": {"advisory": "SVD-2026-1001", "discovery": "INTERNAL"}, "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-10-07T20:46:31.281Z"}, "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "solutions": [{"lang": "en", "value": "Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15, or higher."}], "workarounds": [{"lang": "en", "value": "Turn off the PostgreSQL sidecar by setting `disabled = true` in the `[postgres]` stanza of `$SPLUNK_HOME/etc/system/local/server.conf` if you do not use Edge Processor, OpAmp, or SPL2 data pipelines. Restart Splunk Enterprise to apply the change. For more information see [Sidecar configuration settings](https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) and [server.conf](https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/configuration-file-reference/10.2.7-configuration-file-reference/server.conf) in the Splunk documentation."}], "credits": [{"lang": "en", "value": "Gabriel Nitu, Splunk", "type": "finder"}]}}}

{}

{"affected": [{"affectedData": [{"modules": ["REST API"], "product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"lessThan": "10.4.3", "status": "affected", "version": "10.4", "versionType": "custom"}, {"lessThan": "10.2.7", "status": "affected", "version": "10.2", "versionType": "custom"}]}], "source": "psirt@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.\n\nSplunk Enterprise versions 10.0.x and 9.4.x are not affected."}], "id": "CVE-2026-76268", "lastModified": "2026-10-07T21:17:17.607", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "psirt@cisco.com", "type": "Primary"}]}, "published": "2026-10-07T21:17:17.607", "references": [{"source": "psirt@cisco.com", "url": "https://advisory.splunk.com/advisories/SVD-2026-1001"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "psirt@cisco.com", "type": "Primary"}]}

{}

{}