EUVD-2026-94620
GHSA-rxjh-rj2v-47gx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach unauthenticated Patroni REST API on cluster member
-
ExploitSend crafted configuration operation request
-
ExecutionInject attacker-controlled OS command
-
ImpactExecute arbitrary commands on search head host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Patroni REST API running on a Splunk Enterprise SEARCH HEAD CLUSTER member - the vulnerable interface exists in that clustered sidecar/Patroni configuration, so standalone or non-search-head-clustered deployments are not exposed. Within affected deployments there are no further barriers: the interface requires no authentication for critical configuration operations (CWE-306), consistent with PR:N/UI:N. Affected versions are Splunk Enterprise below 10.4.3 and below 10.2.7; versions 10.0.x and 9.4.x are explicitly NOT affected. Primary limiting factors are therefore (1) whether search head clustering is in use and (2) whether the Patroni REST API port is network-segmented from untrusted callers. |
| Impact | All CVSS signals point to maximum severity: AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H (base 9.8) describes an unauthenticated, low-complexity, network-reachable remote code execution path - the most dangerous combination. CWE-306 (Missing Authentication for a Critical Function) is directly corroborated by the description, which states the Patroni REST API 'does not require authentication for critical configuration operations.' However, several real-risk signals are MISSING and must not be inferred: no EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation probability cannot be quantified - status is 'no public exploit identified at time of analysis.' The one material qualifier that tempers the raw 9.8 is deployment scope: exploitation requires network reachability to the Patroni REST API specifically on a SEARCH HEAD CLUSTER member, so standalone/non-clustered Splunk Enterprise deployments and environments where the Patroni port is network-segmented are not exposed. No SSVC decision data was supplied. Net: this is a genuine high-priority patch item for organizations running search head clustering, but the absence of EPSS/KEV/POC means there is no evidence yet of active or widespread exploitation - prioritize based on exposure of the clustered Patroni interface rather than on confirmed in-the-wild activity. |
| Exploit ScenarioDerived | An attacker with network access to a Splunk search head cluster member reaches the unauthenticated Patroni REST API and issues a configuration operation that injects attacker-controlled operating-system commands, which execute on the underlying host. Because CVSS is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are needed - only reachability of the Patroni port. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Unauthenticated remote command execution in Splunk Enterprise search head cluster members allows any network-reachable attacker to run operating-system commands as the Splunk service account. The flaw (CWE-306) is that the Patroni REST API exposed on a search head cluster member performs critical configuration operations without requiring authentication, so an attacker who can reach that interface can invoke it directly - no credentials needed. Only deployments running search head clustering on Splunk Enterprise versions below 10.4.3 or below 10.2.7 are exposed; 10.0.x and 9.4.x are explicitly unaffected. CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects a maximum-severity, low-complexity path with full confidentiality, integrity and availability impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, so exposure is driven mainly by whether the Patroni REST API port is reachable from untrusted networks.
RemediationAI
Upgrade affected search head cluster members to Splunk Enterprise 10.4.3 or 10.2.7 - the first versions outside the affected ranges - per vendor advisory SVD-2026-1001 (https://advisory.splunk.com/advisories/SVD-2026-1001); this is the only complete fix because the root cause is the absence of authentication on the Patroni REST API itself. If upgrading cannot be done immediately, restrict network access to the Patroni REST API port so that only trusted cluster peers and approved management hosts can reach it, using host firewalls or network segmentation rather than disabling the interface, and verify against the Sidecar configuration settings documentation (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) which ports and endpoints that subsystem requires. Be aware of the trade-off: over-broad blocking of this API can break search head cluster coordination and sidecar configuration propagation, so ACLs must still permit inter-member cluster traffic while excluding untrusted networks and the internet. As a secondary measure, ensure search head cluster members are not exposed to untrusted networks on the management or cluster ports and monitor cluster members for unexpected Patroni REST API requests. There is no vendor-released patch for versions outside the supported fix lines; upgrading within the 10.2 or 10.4 branch to the fixed maintenance release is required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Splunk Enterprise search head clusters rely on a Patroni-based sidecar configuration mechanism, and each cluster member exposes a Representational State Transfer (REST) API used to drive that configuration. The vulnerability class is CWE-306, Missing Authentication for Critical Function: the API performs privileged configuration operations without validating caller identity, so a request from any host with network reachability is treated as trusted. Because these configuration operations ultimately influence the runtime environment of the Splunk process, an attacker can pivot from an unauthenticated HTTP request to attacker-controlled operating-system command execution. The CPE entry cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* is a wildcard match on the product, meaning the authoritative version scoping comes from the description: affected are releases below 10.4.3 and below 10.2.7, while the 10.0.x and 9.4.x lines are unaffected, indicating the vulnerable Patroni/sidecar integration was introduced in the 10.2 and 10.4 branches. The reference to the Splunk sidecar configuration settings documentation points to the same subsystem that must be reviewed when validating exposure and applying compensating controls.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms an unauthenticated network-reachable interface (AV:N/PR:N/UI:N) with no exploitation hurdles (AC:L) yielding OS command execution, so full C/I/A impact on the host.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.
Splunk Enterprise versions 10.0.x and 9.4.x are not affected.
Latest POC
1 public PoC link from nuclei
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical unauthenticated remote command execution flaw in Splunk Enterprise search head cluster members (CVE-2026-76268) allows any network-reachable attacker to execute operating-system commands as the Splunk service account, affecting deployments running search head clustering on versions below 10.4.3 or below 10.2.7; 10.0.x and 9.4.x are unaffected. This creates a maximum-severity risk of full confidentiality, integrity, and availability impact to Splunk data and potentially adjacent systems, though no public exploit identified at time of analysis. Leadership should prioritize confirming network exposure of the Patroni REST API and applying interim segmentation; no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the Patroni REST API to trusted management networks via firewall/ACL rules, blocking the port from untrusted networks, isolating search head cluster members, disabling search head clustering if not required, monitoring Patroni API and Splunk process activity, and applying any vendor-provided workarounds until a patch is available.
Threat Model
4 threats: Elevation of Privilege, Tampering, Information Disclosure and 1 more
3-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB