# Splunk Enterprise Patroni REST API Missing Authentication Leads to Unauthenticated OS Command Execution (CVE-2026-76268)

> CVE-2026-76268 is a missing-authentication flaw (CWE-306, CVSS 9.8) in the Patroni REST API of the PostgreSQL sidecar in Splunk Enterprise 10.4.0-10.4.2 and 10.2.0-10.2.6. An unauthenticated attacker with network access to a search head cluster member can execute attacker-controlled OS commands. A public PoC exists on GitHub; Splunk reports no in-the-wild exploitation.

- **Published:** 2026-10-22T20:43:30Z
- **Last reviewed:** 2026-10-22T20:43:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4182
- **ID:** TL-2026-4182
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-76268

## Description

Splunk advisory SVD-2026-1001 (published 2026-10-07) describes a missing authentication check on critical configuration operations exposed by the Patroni REST API. Patroni is an open-source high-availability manager for PostgreSQL. In Splunk Enterprise 10.x it runs in the PostgreSQL sidecar on search head cluster (SHC) members. An unauthenticated user with network access to that API can execute attacker-controlled operating-system commands on the member. Horizon3.ai notes that internet exposure is not required; reachability from an internal network is enough.

Affected versions for this CVE are Splunk Enterprise 10.4.0 through 10.4.2 and 10.2.0 through 10.2.6. Fixes are 10.4.3 and 10.2.7. Horizon3.ai and secondary reporting state that the 10.0.x and 9.4.x branches are not affected by this CVE. The SVD-2026-1001 advisory covers 17 CVEs and lists 10.0.10 and 9.4.15 as fixed versions for other issues in the bundle. Splunk does not document a fixed port: its example configuration uses a port, but the IPC Broker assigns a random available port when no service address is configured, so defenders should not check only TCP 8008.

A public PoC (github.com/murrez/CVE-2026-76268, Python with requests/urllib3) shows the mechanism. Per an automated read of the repository, which was not independently verified, it fingerprints Patroni with GET /patroni and sends an unauthenticated PATCH /config that sets PostgreSQL dynamic parameters. These include archive_command, wal_level=replica, archive_mode=always and archive_timeout=1. It then sends POST /restart so PostgreSQL applies the configuration, and archive_command runs a shell command on the next WAL archival cycle, about 3 seconds later. The PoC's default proof command writes /tmp/POCBIT-76268-OK, and it can verify execution via an out-of-band callback. It has check, exploit and mass (threaded) modes. Preconditions per the PoC are that the target is an SHC member, the [postgres] sidecar is enabled, and the Patroni port is reachable. A SIEM host compromise can expose ingested data and credentials and allow tampering with logs, which raises the priority of this flaw.

Splunk reports no exploitation at advisory time and the CVE was not listed in CISA KEV in the sources reviewed. No threat actor, malware family or network infrastructure has been associated with the flaw. Mitigation is to upgrade. If Edge Processor, OpAmp and SPL2 data pipelines are unused, set disabled = true under [postgres] in $SPLUNK_HOME/etc/system/local/server.conf and restart. Also restrict access to the Patroni listener to cluster members only.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1046 Network Service Discovery

## Sources

- [Horizon3.ai: CVE-2026-76268 Splunk Enterprise Patroni REST API Missing Authentication](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-76268/)
- [Splunk Security Advisory SVD-2026-1001](https://advisory.splunk.com/advisories/SVD-2026-1001)
- [Public PoC: murrez/CVE-2026-76268](https://github.com/murrez/CVE-2026-76268)
- [CVE.org Record CVE-2026-76268](https://www.cve.org/CVERecord?id=CVE-2026-76268)
- [NVD: CVE-2026-76268](https://nvd.nist.gov/vuln/detail/CVE-2026-76268)
- [Pentest-Tools: Splunk Enterprise Patroni REST API Missing Authentication RCE](https://pentest-tools.com/vulnerabilities-exploits/splunk-enterprise-patroni-rest-api-missing-authentication-rce_29825)
- [GBHackers: Critical Splunk Enterprise Vulnerability](https://gbhackers.com/critical-splunk-enterprise-vulnerability/amp/)
- [Splunk Docs: Sidecar configuration settings](https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4182