CVE-2026-76268

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7

Description An unauthenticated user with network access to the Patroni REST API on a search head cluster member can execute arbitrary operating-system commands. This occurs because the interface fails to require authentication for critical configuration operations.

Recommendations Update Splunk Enterprise to version 10.4.3 or later. Update Splunk Enterprise to version 10.2.7 or later.