Splunk Enterprise Patroni REST API - Missing Authentication RCE

criticalseverity

9.8CVSS score

5.7%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 expose the Patroni REST API (PostgreSQL sidecar) on SHC members without authentication. An unauthenticated attacker can PATCH /config to set a malicious archive_command and POST /restart to trigger it, achieving remote code execution with the privileges of the PostgreSQL process via the classic Patroni RCE chain.

Impact

An unauthenticated attacker with network access to the Patroni port can achieve remote code execution on the Splunk Enterprise server through PostgreSQL archive_command injection.

Fix

Upgrade Splunk Enterprise to version 10.2.7 or 10.4.3 or later.

How to confirm it

Send: GET /patroni
Positive when: contains_all(body, "\"patroni\"", "\"state\"", "\"role\"") and status_code == 200
Send: GET /config
Positive when: contains(body, "\"postgresql\"") and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-76268 -u <target>

The full check

id: CVE-2026-76268

info:
  name: Splunk Enterprise Patroni REST API - Missing Authentication RCE
  author: DhiyaneshDk
  severity: critical
  description: |
    Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 expose the Patroni REST API (PostgreSQL sidecar) on SHC members without authentication. An unauthenticated attacker can PATCH /config to set a malicious archive_command and POST /restart to trigger it, achieving remote code execution with the privileges of the PostgreSQL process via the classic Patroni RCE chain.
  impact: |
    An unauthenticated attacker with network access to the Patroni port can achieve remote code execution on the Splunk Enterprise server through PostgreSQL archive_command injection.
  remediation: |
    Upgrade Splunk Enterprise to version 10.2.7 or 10.4.3 or later.
  reference:
    - https://advisory.splunk.com/advisories/SVD-2026-1001
    - https://pocbit.org/pocs/cve-2026-76268
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-76268
    epss-score: 0.05746
    epss-percentile: 0.93125
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    vendor: splunk
    product: splunk_enterprise
    shodan-query: html:"patroni"
    fofa-query: body="patroni"
  tags: cve,cve2026,splunk,patroni,postgresql,rce,unauth,misconfig

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /patroni HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'contains_all(body, "\"patroni\"", "\"state\"", "\"role\"")'
          - 'status_code == 200'
        condition: and

  - raw:
      - |
        GET /config HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "\"postgresql\"")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from