轉發 國家資安資訊分享與分析中心 資安訊息警訊 NISAC-200-202610-00000010

[內容說明]
研究人員發現Splunk Enterprise存在缺乏身分鑑別(Missing Authentication)漏洞(CVE-2026-76268)，未經身分鑑別之遠端攻擊者，可利用Search Head叢集成員之Patroni REST API對關鍵組態操作未要求身分鑑別之缺陷，進而執行任意作業系統指令，請儘速確認並進行處置。

[影響平台]
Splunk Enterprise 10.4.0至10.4.2版本
Splunk Enterprise 10.2.0至10.2.6版本

[建議措施]
官方已針對漏洞釋出修補或更新，請參考官方說明進行處置，網址如下： https://advisory.splunk.com/advisories/SVD-2026-1001

緩解方式： 若未使用Edge Processor、OpAmp或SPL2 Data Pipelines，可關閉PostgreSQL Sidecar(在$SPLUNK_HOME/etc/system/local/server.conf之[postgres]區段設定disabled = true)，再重啟Splunk Enterprise套用變更。

[參考資料]
1. https://nvd.nist.gov/vuln/detail/CVE-2026-76268
2. https://advisory.splunk.com/advisories/SVD-2026-1001
Forwarded National Information and Analysis Center for Cyber Security Cybersecurity Information Alert NISAC-200-202610-00000010

[Description]
Researchers have discovered a Missing Authentication vulnerability (CVE-2026-76268) in Splunk Enterprise. An unauthenticated remote attacker can exploit a flaw in the Patroni REST API of Search Head cluster members that allows critical configuration operations without requiring authentication, thereby executing arbitrary operating system commands. Please confirm and take action as soon as possible.

[Affected Platforms]
Splunk Enterprise versions 10.4.0 to 10.4.2
Splunk Enterprise versions 10.2.0 to 10.2.6

[Recommended Measures]
The vendor has released patches or updates for the vulnerability. Please refer to the official instructions for remediation. The URL is as follows: https://advisory.splunk.com/advisories/SVD-2026-1001

Mitigation: If Edge Processor, OpAmp, or SPL2 Data Pipelines are not in use, the PostgreSQL Sidecar can be disabled (set disabled = true in the [postgres] section of $SPLUNK_HOME/etc/system/local/server.conf), then restart Splunk Enterprise to apply the changes.

[References]
1. https://nvd.nist.gov/vuln/detail/CVE-2026-76268
2. https://advisory.splunk.com/advisories/SVD-2026-1001