- Horizon3.ai reports that CVE-2026-76268 lets an unauthenticated attacker run operating-system commands through the Patroni REST API on a Splunk Enterprise search head cluster member.
- Internet exposure is not required. Network access to the interface is enough, so internal segmentation matters as much as the perimeter.
- Affected: Splunk Enterprise 10.4.0-10.4.2 and 10.2.0-10.2.6. Fixed in 10.4.3 and 10.2.7. Splunk offers a workaround for sites that skip certain features.
The danger here is the inside of the network
Most security budgets are built around keeping attackers out. CVE-2026-76268 is a reminder that many serious flaws are reached from the inside. Horizon3.ai, the security firm that published the analysis, says the attacker does not need to be on the internet. Someone already inside the network, with a route to the vulnerable interface, could also use it.
That changes who should be worried. It is not only the team that runs the firewall. It is also whoever decides which internal systems can talk to which. A phished laptop or a compromised contractor account may be enough to put an attacker on the right network.
What was found
Splunk rates the flaw 9.8 (Critical) on the CVSS v3.1 scale. Horizon3 describes it as missing authentication on the Patroni REST API of a search head cluster member in Splunk Enterprise. The API does not require a login for critical configuration operations. Abusing those operations lets an attacker execute operating-system commands.
The weakness is classed as CWE-306, Missing Authentication for Critical Function. In plain words, a powerful control panel was left without a lock.
The CVSS vector spells out how easy this is. It needs network access, low complexity, no privileges and no user interaction. Nobody has to click anything. Horizon3 says the impact on confidentiality, integrity and availability could be high.
Which versions are affected
Splunk published advisory SVD-2026-1001 on October 7, 2026, and the CVE record went public the same day. Horizon3 lists the vulnerable builds as Splunk Enterprise 10.4.0 through 10.4.2 and Splunk Enterprise 10.2.0 through 10.2.6.
Customers on the 10.4 line should move to 10.4.3 or any later release. Those on the 10.2 line should move to 10.2.7 or later. Horizon3 states that the 10.0.x and 9.4.x lines do not carry this flaw.
What is known about exploitation
Splunk's advisory does not report active exploitation. Horizon3 points to a public repository with code described as a proof of concept. The report does not say whether that code has been verified.
Those two facts sit side by side. There is no reported attack, yet there is public code that could shorten the work for anyone who tries.
A side component most teams may not know they run
The vendor workaround is revealing. Splunk suggests switching off the PostgreSQL sidecar for teams that cannot upgrade right away. That only applies if they use none of Edge Processor, OpAmp or SPL2 data pipelines. The change is a setting in the server.conf file, followed by a restart.
The lesson here is that the exposure may come from a supporting component, not a feature the team chose. A sidecar is a helper process that runs next to the main product. Teams that never adopted those three features could still be running it.
This is the publication's reading, not a finding of the report. Inventory work rarely lists helper services. If nobody can say which clusters run this one, nobody can say whether they are exposed.
What leaders should ask their teams
First, which Splunk Enterprise versions do we run, and are any between 10.4.0 and 10.4.2 or between 10.2.0 and 10.2.6? Second, who can reach the Patroni REST API on search head cluster members, and should they be able to?
Third, do any of our systems rely on Edge Processor, OpAmp or SPL2 data pipelines? If none do, the sidecar workaround is an option while the upgrade is scheduled. Fourth, after the fix, how will we confirm it worked? Horizon3 sells a NodeZero Rapid Response test for this purpose. It is a vendor product, so teams can use it or any equivalent check.
A flaw that needs no internet exposure is a test of how well an organisation knows its own interior. The perimeter may be sound. The question is what an intruder can reach once inside.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Horizon3.ai.
