CVE-2026-76298

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8

Description A user without admin or power roles can derive the PostgreSQL sidecar database superuser password. This occurs because the PostgreSQL sidecar service derives a privileged password from the search head cluster identifier found in search job logs. An attacker can leverage this to execute arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members.

Recommendations Update to version 10.4.4 or later. Update to version 10.2.8 or later.