{"id":"CVE-2026-76268","published":"2026-10-07T21:17:17.607","lastModified":"2026-10-09T04:18:12.730","description":"In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.\n\nSplunk Enterprise versions 10.0.x and 9.4.x are not affected.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-1001","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthenticated users to execute arbitrary commands on the affected Splunk Enterprise server via the Patroni REST API, posing a significant risk to system security.","exploitability":"Exploitation is relatively straightforward for an attacker with network access to the REST API, as no authentication is required for critical configuration operations.","blast_radius":"If exploited, this vulnerability could lead to complete compromise of the affected Splunk Enterprise server, potentially allowing attackers to control the system and access sensitive data.","remediation":"Upgrade to Splunk Enterprise version 10.4.3 or later, or apply the relevant patch for versions 10.2.7 and earlier.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","web","api"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:40:53.257Z"}}