CVE-2026-76268: The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. in Splunk Splunk Enterprise

In Splunk Enterprise versions >=10.2 <10.2.7 and >=10.4 <10.4.3, the Patroni REST API on search head cluster members does not require authentication for critical configuration functions. This flaw enables unauthenticated users with network access to execute attacker-controlled OS commands. The vulnerability arises because the API lacks enforcement of user identity verification for sensitive operations. This issue is documented in Splunk's sidecar configuration settings documentation. Versions 10.0.x and 9.4.x are confirmed unaffected.

An unauthenticated attacker with network access to the Patroni REST API on a Splunk Enterprise search head cluster member can execute arbitrary operating system commands. This leads to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score is 9.8 (critical), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Splunk Enterprise versions 10.2.x and 10.4.x should be upgraded to at least 10.2.7 and 10.4.3 respectively, where this vulnerability is fixed. Versions 10.0.x and 9.4.x are not affected. No other mitigations are indicated. Patch status is confirmed by the version boundaries in the affectedVersions field. Users should apply the official fixes promptly.