In Splunk Enterprise versions below 10.4.3 and 10.2.7, the Patroni Representational State Transfer (REST) API on a head cluster member does not require authentication for critical configuration operations, allowing attackers to execute arbitrary operating-system commands.
An unauthenticated attacker with network access to the Patroni REST API on a head cluster member can execute arbitrary operating-system commands on the affected system.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Yes, patches are available. Splunk Enterprise versions 10.4.3 and 10.2.7 or later address this vulnerability.
Update Splunk Enterprise to version 10.4.3, 10.2.7, or later. Restrict network access to the Patroni REST API to trusted networks only. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-76268 . See article
NVD published the first details for CVE-2026-76268
A CVSS base score of 9.8 has been assigned.
GitHub Advisories released a security advisory .
A critical authentication bypass vulnerability has been identified in the REST API of the Patroni when deployed in a Splunk Enterprise head cluster, with a CVSS score of 9.8. There is currently no public proof-of-concept available, and while mitigation measures are under review, the vulnerability remains unlisted in the CISA KEV. Affected versions include those below 10, and there is no indication of its exploitation in the wild. See article
[GHSA-rxjh-rj2v-47gx] In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user w
SVD-2026-1001: Security Vulnerabilities in Splunk Enterprise - September/October 2026
CVE-2026-76268: Splunk Enterprise Patroni API Unauthenticated RCE
CVE-2026-92555: AKINSOFT WOLVOX Control Panel Data Leakage Exposes System Resources
CVE-2026-76268 - Exploits & Severity - Feedly
Cyber Security News for October 8 2026 - Daily DefSec Brief
CVE-2026-92555: AKINSOFT WOLVOX Control Panel Data Leakage Exposes System Resources
CVE-2026-105110: Iskratel Innbox GPON ONT OS Command Injection Grants Unauthenticated Root Access
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
