Splunk’s cluster-coordination sidecar. Loom’s agent control plane. ClearPass’s network admission layer. SonicWall’s remote-access edge. Four vendors, four architectures, one missing check: in every case the component that arbitrates trust shipped without asking who was asking.
The class has a name. Missing authentication for a critical function (CWE-306) covers products that perform no authentication for functionality that requires a provable user identity or consumes significant resources. MITRE’s notes on how the weakness enters code describe the habit precisely: developers secure the primary channel, then leave open a secondary channel they assume is private. The weakness has sat in the CWE Top 25 since 2023. In these four disclosures the secondary channel is a cluster API, an agent control plane, a network access controller, and a VPN appliance’s proxy layer.
Splunk Enterprise. On Oct. 7, advisory SVD-2026-1001 published CVE-2026-76268 at CVSS 9.8: the Patroni REST API on a search head cluster member, the coordination interface behind the PostgreSQL sidecar, does not require authentication for critical configuration operations. Any unauthenticated user with network access to it can run attacker-controlled operating-system commands. For operators who cannot upgrade and do not use Edge Processor, OpAmp or SPL2 pipelines, Splunk’s own mitigation is to remove the surface outright (disabled = true in the [postgres] stanza of server.conf). The find was internal, credited to Gabriel Nitu. No active exploitation is reported and the CVE is not in CISA’s Known Exploited Vulnerabilities catalog. The details sit in our Splunk write-up. The platform enterprises deploy to watch everything else has an unauthenticated door in its own coordination layer.
Loom for AWS. CVE-2026-103956 is the starkest of the four. In Loom versions before 1.6.1, deployed with no identity provider configured, the authentication dependency returned a fixed t-admin/g-admins-super identity for every request to the application API, including requests carrying no Authorization header at all. The GitHub security advisory is blunt about the population affected: not a rare edge case, but the state of a freshly deployed instance before an operator has completed IdP setup. That identity granted full administrative authority over the agent control plane: registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, which is the path from the orchestration layer into the underlying AWS environment. The official score on the NVD record is CVSS v4.0 10.0, Critical, issued by Amazon’s CNA, with CWE-306 and CWE-1188 underneath it. We covered the flaw in our Oct. 6 Loom coverage.
HPE ClearPass. HPE advisory HPESBNW05158 rev.1, published Oct. 6, lists 28 vulnerabilities in ClearPass Policy Manager: ten critical, eleven high, seven medium. ClearPass is the network access control platform that decides what gets onto the enterprise network at more than 5,000 organizations, and two of its criticals carry the shape of everything else here. CVE-2026-76750, CVSS 9.8, is an unauthenticated deserialization flaw that reaches remote code execution through the web interface. CVE-2026-76752 is an unauthenticated authentication bypass that grants administrative access to the web-based management and API interfaces. Fixes shipped in versions 6.11.16 and 6.14.1. Our ClearPass breakdown covers the full cluster. As of publication, no in-the-wild exploitation.
SonicWall SMA 1000. CVE-2026-102255 scores 10.0 and needs no credential at all. A pre-authentication SSRF through an unintended access path in the Work Place interface turns the appliance into a confused deputy (CWE-918 and CWE-441): per advisory SNWLID-2026-0017, an unauthenticated attacker can direct the appliance to issue requests on their behalf and reach internal functionality. Workaround: none. Three post-authentication bugs sit behind that door in the same bundle. It is also the third SMA 1000 disclosure opening the same way, and our SonicWall analysis draws the line through all three.
The Loom line earns its own paragraph because of the calendar. The fix shipped on Aug. 4. The disclosure published Oct. 2. For nearly two months the missing-authentication door had a patch and no public notice, and a public proof-of-concept repository now sits at the end of that timeline. The 2026-124-aws bulletin also shows why a version bump is not a remediation here: because the missing check could expose OAuth2 secrets, access tokens and IAM session credentials, AWS’s after-upgrade list runs to rotating client secrets, revoking tokens, rotating IAM session credentials and reviewing CloudTrail. Patching restores the check. It does not restore the integrity of anything that passed through while the check was absent.
None of the four disclosures reports exploitation in the wild. Say that plainly, then set it aside, because the design failure does not depend on it. Each of these products shipped a critical function on the assumption that the network around it was private. The fix in every case is the same sentence: make the interface prove who is asking. Operators can inventory their control-plane interfaces for the pattern this week. Builders can stop filing the secondary channel under somebody else’s problem. The private network was the assumption, and the assumption is the bug.