CVE-2026-76298: The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. in Splunk Splunk Enterprise

In affected Splunk Enterprise versions, the PostgreSQL sidecar service uses a hard-coded cryptographic key derived from the search head cluster identifier to generate a privileged database password. Since this identifier appears in search job logs accessible to users without admin or power roles, these users can recover the superuser password for the PostgreSQL sidecar database. This enables them to run arbitrary operating system commands with the privileges of the Splunk Enterprise user on search head cluster members, leading to a high-impact security breach.

An attacker with limited Splunk roles (not admin or power) can escalate privileges by deriving the PostgreSQL sidecar superuser password and executing arbitrary OS commands as the Splunk Enterprise user on search head cluster members. This compromises confidentiality, integrity, and availability of the affected systems, as indicated by the CVSS score of 8.8 (high severity).

A fix is available in Splunk Enterprise versions 10.2.8 and 10.4.4 and later. Users should upgrade to these or newer versions to remediate the vulnerability. No other mitigations are indicated in the vendor documentation.