Splunk Enterprise Patroni REST API Has Unauthenticated OS Command Execution That Ships Without Authentication

The SIEM platform that enterprises deploy to monitor security events across their infrastructure now requires its own monitoring, following the disclosure of an unauthenticated remote code execution vulnerability in its internal management layer. CVE-2026-76268, a critical flaw with a CVSS score of 9.8, resides in the Patroni REST API used by Splunk Enterprise search head cluster members. Because this API lacks authentication, any actor with network access to the endpoint can execute arbitrary OS commands on the underlying infrastructure. The vulnerability centers on the PostgreSQL sidecar, a component responsible for high-availability cluster coordination.

Source: Forkast