Loading story…
Splunk released two security advisories addressing 17 vulnerabilities in Splunk Enterprise and associated components, including CVE-2026-76268, a critical missing-authentication flaw in the Patroni REST API on search head cluster members. Attackers with network access to the affected interface can execute operating system commands without credentials or user interaction. The flaw affects Enterprise 10.4.0–10.4.2 and 10.2.0–10.2.6; the 10.0.x and 9.4.x branches are explicitly unaffected by this vulnerability. The additional disclosures cover privilege escalation, SQL injection, denial of service, access-control failures, information disclosure, and server-side request forgery that can expose authentication tokens, with hardening updates spanning all four branches.
Administrators should upgrade affected search head cluster members to 10.4.3 or 10.2.7, apply the relevant fixes for other affected branches and components, and restrict network access to the Patroni API. Where immediate patching is not possible and the specified features are unused, Splunk provides a conditional workaround to disable the PostgreSQL sidecar. Severity reporting differs between the references: one cites 9.1, while another reports a CVSS v3.1 score of 9.8 for the critical flaw. At publication, reporting identified no known public proof-of-concept exploit or active exploitation and stated that the vulnerability was not in CISA’s Known Exploited Vulnerabilities catalog.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-1018 covering Splunk Enterprise and Splunk MCP Server, referencing the previously unrecorded MCP Server advisory SVD-2026-1004. It urged administrators to review Splunk's advisories and apply necessary updates, without specifying MCP Server versions or technical vulnerability details.
Splunk published advisories SVD-2026-1001 and SVD-2026-1002 covering vulnerabilities in Splunk Enterprise and associated components. The disclosures included critical Patroni remote command execution, privilege escalation, SQL injection, denial of service, access-control failures, information disclosure, and token-exposing SSRF weaknesses.
Splunk released fixes in Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 for the applicable vulnerabilities. The Patroni flaw is fixed in 10.4.3 and 10.2.7; the 10.0.x and 9.4.x branches are unaffected by that specific vulnerability.
Splunk identified the disclosed vulnerabilities internally and credited researcher Gabriel Nitu with discovering CVE-2026-76268. The flaw allows attackers with network access to the Patroni REST API on affected search head cluster members to execute operating system commands without authentication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourceacn.gov.it
Open sourcecybersecuritynews.com
Open sourcethreataft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk released fixes for multiple product vulnerabilities, led by **`CVE-2026-20253`**, a critical **unauthenticated remote code execution** flaw in the PostgreSQL sidecar service used by Splunk Enterprise. The bug stems from missing authentication on the sidecar endpoint and can be abused for arbitrary file creation or truncation, enabling full compromise of the Splunk application environment. Affected Splunk Enterprise versions include releases earlier than **10.4.0**, **10.2.4**, and **10.0.7**, while Splunk Cloud Platform fixes include **10.4.2604.3** for the related exposure. Security sources reported that **`CVE-2026-20253`** is being actively exploited in limited, targeted attacks, prompting **CISA** to add it to the **Known Exploited Vulnerabilities** catalog and require rapid federal remediation. Splunk’s broader June security updates also addressed **`CVE-2026-20251`**, a remote code execution issue tied to unsafe `jsonpickle` deserialization in KV Store data, along with additional SSRF, XSS, CSS injection, access-control bypass, and data-exposure flaws across Splunk Enterprise, Splunk Cloud Platform, Splunk Secure Gateway, and Splunk SOAR. Organizations unable to patch immediately were advised to disable the PostgreSQL sidecar service and hunt for signs of exploitation such as path traversal requests, unexpected `pg_dump` or `pg_restore` execution, suspicious dump files, and outbound connections to unknown PostgreSQL servers.
Jul 8, 2026
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jul 23, 2026
Splunk released security updates for multiple vulnerabilities in **Splunk Enterprise** and **Splunk Cloud Platform**, led by **`CVE-2026-20296`**, a high-severity flaw in the Deployment Server component of Splunk Web. The bug combines missing CSRF validation on `GET` requests with improper neutralization of user-controlled input, allowing an attacker to trick a user with the `list_deployment_server` capability into triggering arbitrary SPL searches as `splunk-system-user`. Successful exploitation could expose indexed data and stored credentials, with additional integrity and limited availability impact. The update also addresses **`CVE-2026-20297`** in the App Install REST endpoint and **`CVE-2026-20298`** in the `storage/passwords` REST endpoint, which could enable path traversal and disclosure of stored credential hashes. Splunk published patched versions and mitigation guidance for customers, while **Splunk Cloud Platform** instances are being patched and monitored by Splunk. **Splunk Enterprise** administrators were advised to upgrade promptly and apply a configuration change to reduce exposure from the credential-hash disclosure issue.
Jul 17, 2026