Threat reportVulnerabilityTL-2026-4182
Splunk Enterprise Patroni REST API Missing Authentication Leads to Unauthenticated OS Command Execution (CVE-2026-76268)
Splunk Enterprise Patroni REST API Missing Authentication (TL-2026-4182), also tracked as SVD-2026-1001, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-22. It has no confirmed attribution, affects Splunk Splunk Enterprise (search head cluster members, PostgreSQL, references 1 CVE (CVE-2026-76268), maps to 5 MITRE ATT&CK techniques (T1046, T1059.004, T1190), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4182
- Threat ID
- TL-2026-4182
- Also known as
- SVD-2026-1001, Splunk Patroni REST API RCE
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Splunk Enterprise Patroni REST API Missing Authentication
Malware and tooling: murrez/CVE-2026-76268 PoC (Python, requests/urllib3)
How Splunk Enterprise Patroni REST API Missing Authentication works
CVE-2026-76268 is a missing-authentication flaw (CWE-306, CVSS 9.8) in the Patroni REST API of the PostgreSQL sidecar in Splunk Enterprise 10.4.0-10.4.2 and 10.2.0-10.2.6. An unauthenticated attacker with network access to a search head cluster member can execute attacker-controlled OS commands. A public PoC exists on GitHub; Splunk reports no in-the-wild exploitation.
Splunk advisory SVD-2026-1001 (published 2026-10-07) describes a missing authentication check on critical configuration operations exposed by the Patroni REST API. Patroni is an open-source high-availability manager for PostgreSQL. In Splunk Enterprise 10.x it runs in the PostgreSQL sidecar on search head cluster (SHC) members. An unauthenticated user with network access to that API can execute attacker-controlled operating-system commands on the member. Horizon3.ai notes that internet exposure is not required; reachability from an internal network is enough.
Affected versions for this CVE are Splunk Enterprise 10.4.0 through 10.4.2 and 10.2.0 through 10.2.6. Fixes are 10.4.3 and 10.2.7. Horizon3.ai and secondary reporting state that the 10.0.x and 9.4.x branches are not affected by this CVE. The SVD-2026-1001 advisory covers 17 CVEs and lists 10.0.10 and 9.4.15 as fixed versions for other issues in the bundle. Splunk does not document a fixed port: its example configuration uses a port, but the IPC Broker assigns a random available port when no service address is configured, so defenders should not check only TCP 8008.
A public PoC (github.com/murrez/CVE-2026-76268, Python with requests/urllib3) shows the mechanism. Per an automated read of the repository, which was not independently verified, it fingerprints Patroni with GET /patroni and sends an unauthenticated PATCH /config that sets PostgreSQL dynamic parameters. These include archive_command, wal_level=replica, archive_mode=always and archive_timeout=1. It then sends POST /restart so PostgreSQL applies the configuration, and archive_command runs a shell command on the next WAL archival cycle, about 3 seconds later. The PoC's default proof command writes /tmp/POCBIT-76268-OK, and it can verify execution via an out-of-band callback. It has check, exploit and mass (threaded) modes. Preconditions per the PoC are that the target is an SHC member, the [postgres] sidecar is enabled, and the Patroni port is reachable. A SIEM host compromise can expose ingested data and credentials and allow tampering with logs, which raises the priority of this flaw.
Splunk reports no exploitation at advisory time and the CVE was not listed in CISA KEV in the sources reviewed. No threat actor, malware family or network infrastructure has been associated with the flaw. Mitigation is to upgrade. If Edge Processor, OpAmp and SPL2 data pipelines are unused, set disabled = true under [postgres] in $SPLUNK_HOME/etc/system/local/server.conf and restart. Also restrict access to the Patroni listener to cluster members only.
MITRE ATT&CK techniques used in TL-2026-4182
Discovery
T1046 Network Service Discovery
Execution
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
Reconnaissance
Affected products and versions in Splunk Enterprise Patroni REST API Missing Authentication
- Splunk — Splunk Enterprise (search head cluster members, PostgreSQL sidecar / Patroni)
Vulnerable versions: 10.4.0-10.4.2; 10.2.0-10.2.6
Fixed in: 10.4.3; 10.2.7
Remediation for Splunk Enterprise Patroni REST API Missing Authentication
Patches
- Splunk Enterprise 10.4.3
- Splunk Enterprise 10.2.7
Immediate actions
- Upgrade Splunk Enterprise to 10.4.3 or later (10.4 branch) or 10.2.7 or later (10.2 branch)
- Restrict network access to the Patroni REST API listener on search head cluster members to authorized cluster nodes only; identify the real port from configuration (postgres:patroni address / IPC Broker) rather than assuming TCP 8008
- Hunt for unauthenticated PATCH /config and POST /restart requests to the Patroni listener and for unexpected archive_command values in the Patroni dynamic configuration
Workarounds
- If Edge Processor, OpAmp and SPL2 data pipelines are unused, set [postgres] disabled = true in $SPLUNK_HOME/etc/system/local/server.conf and restart Splunk Enterprise
Longer-term hardening
- Segment search head cluster management and sidecar interfaces from user and server networks
- Monitor changes to server.conf [postgres] and PostgreSQL dynamic parameters
- Alert on shell child processes of the PostgreSQL sidecar
CVEs associated with Splunk Enterprise Patroni REST API Missing Authentication
Weaknesses (CWE) in Splunk Enterprise Patroni REST API Missing Authentication
Timeline of Splunk Enterprise Patroni REST API Missing Authentication
- Horizon3.ai publishes analysis and develops a NodeZero Rapid Response test; its article references a public PoC on GitHub.
- At advisory time Splunk reports no in-the-wild exploitation; the CVE is not listed in CISA KEV in sources reviewed.
- Splunk Enterprise 10.4.3 and 10.2.7 released as fixed versions for CVE-2026-76268.
- CVE-2026-76268 record created and published (CWE-306, Patroni REST API).
- Splunk publishes advisory SVD-2026-1001 (17 CVEs); CVE-2026-76268 is rated Critical, CVSS 9.8.
- Pentest-Tools adds a network-scanner detection for the Patroni REST API missing-authentication RCE.
Sources cited for Splunk Enterprise Patroni REST API Missing Authentication
- Horizon3.ai: CVE-2026-76268 Splunk Enterprise Patroni REST API Missing Authentication
- Splunk Security Advisory SVD-2026-1001
- Public PoC: murrez/CVE-2026-76268
- CVE.org Record CVE-2026-76268
- NVD: CVE-2026-76268
- Pentest-Tools: Splunk Enterprise Patroni REST API Missing Authentication RCE
- GBHackers: Critical Splunk Enterprise Vulnerability
- Splunk Docs: Sidecar configuration settings
Detection coverage for TL-2026-4182
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4182 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.