Splunk Enterprise Patroni REST API missing authentication permits remote command execution (CVE-2026-76268)

What happened

Splunk's advisory for CVE-2026-76268 describes missing authentication for a critical function in the Patroni REST API on Splunk Enterprise search head cluster members. On affected versions, an unauthenticated user with network access to that API can execute operating-system commands of their choice. No credentials, no prior access, and no user interaction are required; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, giving a score of 9.8 critical.

Because the interface is used for configuration operations on clustered search heads, successful command execution gives the attacker high confidentiality, integrity, and availability impact on the affected system. The weakness is classified as CWE-306, missing authentication for critical function.

Splunk Enterprise 10.0.x and 9.4.x are not affected. The CVE record and Splunk's advisory do not state that the vulnerability has been exploited or publicly disclosed.

Who is affected

Affected releases are Splunk Enterprise 10.4 to before 10.4.3 and 10.2 to before 10.2.7. The affected component is the Patroni REST API on a search head cluster member, so clustered search head deployments running those release lines should treat themselves as affected until updated. Splunk Enterprise 10.0.x and 9.4.x are not affected. The practical exposure depends on network reachability: an attacker needs network access to the API, so instances reachable from untrusted or internet-facing networks are at highest risk.

What to do now

1. Update affected search head cluster members to a fixed release: Splunk Enterprise 10.4.3 or Splunk Enterprise 10.2.7, matching your release family. Apply the update according to Splunk's documentation and your clustered deployment process.
2. Until patching is complete, restrict network access to the Patroni REST API on search head cluster members so that only trusted cluster and management hosts can reach it. Splunk's advisory does not list a separate workaround.
3. After patching, check that no untrusted network paths remain to the Patroni REST API and review cluster member logs for unexpected command execution or configuration changes.

How to detect it

Look for connections to the Patroni REST API from addresses outside your expected cluster and management networks. On affected versions the API does not require authentication, so any reachable instance should be treated as exposed. Review process execution and audit logs on search head cluster members for OS commands or configuration changes that cannot be tied to administrative activity or a change window. Splunk's advisory does not publish specific indicators of compromise.

Beyond the patch

Because this vulnerability is reachable over the network without credentials, an exposed Patroni interface is exactly the kind of open, unauthenticated service that Virtual CISO Services (vCISO) helps you find through exposure management before an advisory forces the issue. Authentication and command-execution flaws are also what Implementation & Assessment Services are designed to uncover in penetration tests and hardening work. And if you run Splunk as part of a broader supplier stack, tracking which vendor software you run and how quickly vendors patch is core Supply Chain Defense & Third-Party Risk work.