CVE-2026-76266 – Splunk Enterprise
“An open door on a search head cluster is an open door to the whole system. Close it today.”
Splunk has released Splunk Enterprise updates that fix two privilege escalation flaws. The more serious one is CVE-2026-76268, with a CVSS score of 9.8, Critical severity. The Patroni REST API on a search head cluster member does not require authentication for critical configuration operations. Any unauthenticated user with network access to it can run attacker-controlled operating-system commands. This flaw affects versions below 10.4.3 and 10.2.7. Versions 10.0.x and 9.4.x are not affected.
CVE-2026-76266 has a CVSS score of 7.7, High severity. It affects Splunk Enterprise on Linux in versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. A local user who can run commands as the Splunk service account can tamper with the installation. The next package upgrade then runs that user's commands with root privileges, because the upgrade script trusts the existing installation content. Upgrading to a fixed release closes both flaws.
Key Details
- Affected Product
- Splunk Splunk
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- High
- User Interaction
- Required
- CWE Classification
- CWE-269