CVE-2026-76268

Executive Summary

CVE-2026-76268 is a critical (CVSS 9.8) missing-authentication vulnerability in Splunk Enterprise search head cluster members, where the Patroni REST API lacks authentication for critical configuration operations, allowing an unauthenticated network-adjacent attacker to execute attacker-controlled operating-system commands. Affected are Splunk Enterprise versions below 10.4.3 and 10.2.7; versions 10.0.x and 9.4.x are explicitly not affected. Successful exploitation yields full compromise of confidentiality, integrity, and availability (C/I/A: High) on the impacted cluster member, making this a high-priority remediation item.

Technical Analysis

The vulnerability is classified as CWE-306: Missing Authentication for Critical Function. Per the NVD description, the exposed component is the Patroni Representational State Transfer (REST) Application Programming Interface (API) running on a Splunk Enterprise search head cluster member. Patroni is the cluster-management layer used to coordinate high-availability state; its REST API is normally used for internal cluster coordination and health checks.

The root cause is that this interface "does not require authentication for critical configuration operations." Because those configuration operations are reachable without authentication, an unauthenticated user who has network access to the Patroni REST API can influence critical configuration in a way that results in the execution of attacker-controlled operating-system commands. The NVD description does not enumerate the specific REST endpoint, HTTP method, or configuration parameter involved, so the precise request structure cannot be stated and is not fabricated here.

Two properties drive severity:

1. Missing authentication (CWE-306) removes the credential barrier entirely — no valid account, token, or session is required.
2. The outcome is operating-system command execution, which is the highest-impact primitive (code execution in the context of the Splunk/Patroni service account).

Network reachability is the gating precondition. The CVSS vector reflects AV:N (network) with PR:N (no privileges) and UI:N (no user interaction), i.e., the attack is remotely triggerable by an unauthenticated party who can route traffic to the API. In typical deployments the Patroni REST API is bound to cluster-internal interfaces; organizations that expose cluster-member ports beyond the trusted segment widen the attack surface materially.

The referenced documentation — Splunk's "Sidecar configuration settings" page — signals the affected configuration domain (sidecar configuration). This is consistent with a design where configuration operations intended to be administratively controlled are instead serviced by an unauthenticated interface.

Scope is unchanged (S:U), meaning impact is confined to the vulnerable Splunk/Patroni security authority; however, within that authority the impact is complete. The EPSS score is 0.00400 (32.1st percentile), and there is no CISA KEV listing, no public PoC, no Nuclei template, and no published exploit code at the time of writing. The absence of public exploit tooling does not reduce urgency given the unauthenticated, command-execution nature of the flaw.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-306, missing authentication for a critical function) and the NVD description. No specific endpoint paths, HTTP methods, or parameter names are asserted because they are not present in the source data.

1. Reconnaissance / target identification. An adversary enumerates Splunk search head cluster members and probes the Patroni REST API for reachability. Because exploitation requires only network access to that API (AV:N), the attacker first establishes which cluster-member hosts expose the Patroni service to a network segment they can reach — for example, from a compromised host inside the same VLAN, a misconfigured perimeter, or an insufficiently segmented management network. Port and service enumeration identifies candidate hosts.

2. Triggering the flaw class. The attacker sends requests to the unauthenticated Patroni REST API that invoke "critical configuration operations." No authentication challenge is presented, so no credential or session is needed. The essential primitive is unauthorized invocation of a configuration-changing operation that the interface fails to protect.

3. Execution method (vulnerability-class level). The unauthorized configuration operation results in the execution of attacker-controlled operating-system commands. At the vulnerability-class level, this is a command-injection-via-configuration primitive: the attacker supplies command content that the service executes in its own security context. The NVD description does not disclose the exact mechanism (e.g., which configuration field carries the command), so no specific payload syntax is provided here.

4. Post-exploitation impact. Command execution occurs in the context of the Splunk/Patroni service. From a search head cluster member the attacker can: read and exfiltrate indexed data and configuration (C:H); alter configuration, indices, and cluster state or deploy further malicious content (I:H); and disrupt or destroy the cluster member's services (A:H). A compromised cluster member can also serve as a pivot into adjacent Splunk infrastructure and the broader internal network, depending on segmentation and service-account privileges.

Because PR:N, UI:N, and AC:L apply, there is no precondition of valid credentials and no reliance on user interaction — only the network reachability and the timing/conditions typical of any unauthenticated request.

Impact Assessment

Business impact is severe. Splunk Enterprise is frequently the central security analytics and log-aggregation platform in an enterprise; compromise of a search head cluster member places sensitive telemetry, credentials, configuration, and potentially the integrity of security monitoring itself at risk. An attacker with OS command execution on a cluster member could (a) access or exfiltrate data, (b) tamper with or delete logs and detections to blind defenders, and (c) disrupt availability of the platform.

CVSS 3.1 base score 9.8 (Critical) with subscores: AV:N — remotely reachable; AC:L — no special conditions; PR:N — no authentication required; UI:N — no user action needed; S:U — impact is scoped to the vulnerable component; C:H/I:H/A:H — total loss of confidentiality, integrity, and availability within that scope.

Blast radius: primarily affected are Splunk Enterprise search head cluster members running versions < 10.4.3 (10.4.x) and < 10.2.7 (10.2.x). Explicitly not affected are 10.0.x and 9.4.x. The blast radius expands with the reachability of the Patroni REST API — internet-exposed or flatly-segmented deployments are highest risk, while tightly isolated cluster-internal networks lower practical exposure but do not eliminate the missing-authentication defect.

Given CISA KEV: NO, EPSS 0.00400, and no public exploit, mass opportunistic exploitation is not currently evidenced. However, the low attack complexity and no-auth requirement make this an attractive target for targeted actors should exploitation details become public, and the score justifies emergency-change treatment.

Detection Guidance

Sigma Rule

title: Suspicious Unauthenticated Patroni REST API Configuration Access on Splunk Search Head
id: 8f1c2b3a-7626-4c68-9f00-202676268aaa
status: experimental
description: Detects network or process activity consistent with unauthorized access to the Patroni REST API on a Splunk search head cluster member leading to OS command execution (CVE-2026-76268).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76268
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026.76268
logsource:
  category: webserver
  product: splunk
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_patroni:
    cs-uri-stem|contains:
      - '/patroni'
      - '/config'
      - '/restart'
  selection_noauth:
    sc-status:
      - 200
      - 202
  condition: selection_method and selection_patroni and selection_noauth
falsepositives:
  - Legitimate internal Patroni cluster coordination from peer nodes
level: high

YARA Rule

rule CVE_2026_76268_Splunk_Patroni_Unauth_OS_Command
{
    meta:
        description = "Detects artifacts consistent with unauthenticated Patroni REST API abuse on Splunk search head cluster members (CVE-2026-76268)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76268"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $patroni = "patroni" ascii wide nocase
        $splunk = "splunk" ascii wide nocase
        $api    = "rest" ascii wide nocase
        $exe1   = "/bin/sh -c" ascii wide
        $exe2   = "/bin/bash -c" ascii wide
        $exe3   = "cmd.exe /c" ascii wide
    condition:
        ($patroni and $splunk and $api) and 1 of ($exe*)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-76268 Splunk Patroni REST API Unauthenticated Access Attempt"; flow:established,to_server; content:"patroni"; http_uri; nocase; content:"config"; http_uri; nocase; pcre:"/(POST|PUT|PATCH)\s+\/[^\s]*patroni[^\s]*/iU"; classtype:attempted-admin; reference:cve,2026-76268; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76268; sid:202676268; rev:1;)

Elastic Detection

sequence by host.id with maxspan=2m
  [ network where network.protocol == "http" and
      url.path : "*patroni*" and
      http.request.method in ("POST","PUT","PATCH") ]
  [ process where event.type == "start" and
      process.parent.name : "*patroni*" and
      process.name in ("sh","bash","cmd.exe","powershell.exe") ]

Splunk SPL Query

index=web OR index=splunk
| search (uri_path="*patroni*" OR uri_path="*config*")
| where http_method IN ("POST","PUT","PATCH")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as paths values(src_ip) as sources
        by host status
| where status IN ("200","202") AND count > 0
| sort - count

Wazuh OSSEC Rule

<group name="splunk,patroni,cve-2026-76268,">
  <rule id="2026768" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*patroni.*</field>
    <field name="method">POST|PUT|PATCH</field>
    <description>CVE-2026-76268: Potential unauthenticated Patroni REST API access on Splunk search head cluster member.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_76268,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Per NVD, the fix is delivered by upgrading to Splunk Enterprise 10.4.3 or 10.2.7; this upgrade target is the authoritative remediation path even though no vendor patch artifact was tracked in the provided sources.

1. Immediate mitigations

• Network-isolate the Patroni REST API. Restrict access to the Patroni service port so that only trusted cluster-member peers can reach it, using host-based firewalls, security groups, or network ACLs. Do not expose cluster-member management interfaces to untrusted or perimeter-reachable networks.
• Segment management/clustering networks away from user and internet-reachable segments.
• Audit current exposure: enumerate search head cluster members running 10.2.x (<10.2.7) or 10.4.x (<10.4.3) and confirm whether the Patroni API is reachable beyond the trusted cluster boundary.
• Monitor egress and process execution on cluster members for unexpected child processes spawned by the Splunk/Patroni service account.

2. Patch / upgrade steps

• Upgrade Splunk Enterprise to 10.4.3 or 10.2.7 (or later) as indicated by the NVD description.
• Apply the upgrade across all affected search head cluster members to eliminate the missing-authentication condition at its source.
• Note that versions 10.0.x and 9.4.x are reported not affected; validate your exact running version before prioritizing hosts.

3. Long-term hardening

• Enforce authentication and authorization on all management and coordination APIs; treat unauthenticated internal APIs as defects.
• Adopt zero-trust network segmentation for Splunk cluster components and management planes.
• Maintain an asset inventory with vulnerability correlation to catch version drift and confirm fix coverage.
• Deploy the detection content above and retain web/proxy and process telemetry for post-incident forensics.
• Track vendor advisories and the NVD entry for CVE-2026-76268 for any updated patch or exploit information.

References

• NVD — CVE-2026-76268: https://nvd.nist.gov/vuln/detail/CVE-2026-76268
• Splunk documentation — Sidecar configuration settings: https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings
• CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog (status: not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog