Use of Hard-coded Cryptographic Key in Splunk Enterprise - CVE-2026-76298
Published: October 22, 2026
Vulnerability identifier: #VU156982
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76298
CWE-ID: CWE-321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to derive the PostgreSQL sidecar database superuser password and execute arbitrary operating system commands as the account running Splunk Enterprise on search head cluster members.
The vulnerability exists due to use of a hard-coded cryptographic key in the Splunk Enterprise PostgreSQL sidecar service when deriving a privileged database password from the search head cluster identifier. A remote user can obtain this identifier from search job logs and derive the database superuser password to execute arbitrary operating system commands as the account running Splunk Enterprise on search head cluster members.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-76298
Install security update from vendor's website.
Splunk Enterprise - addressed in versions 9.4.16, 10.0.11, 10.2.8, 10.4.4