CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
- Record
CVE-2026-20253- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2026-36088
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
- Record
EUVD-2026-36088- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xgm5-jh99-wc4v
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below...
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.
- Record
GHSA-xgm5-jh99-wc4v- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
CISA KEV No score
Splunk Enterprise Missing Authentication for Critical Function Vulnerability
Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.
- Record
CVE-2026-20253- Weakness
- CWE-306
- Updated
- 2026-11-02
NVD
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
- Record
CVE-2026-20253- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253 | 2026-06-12 |
| PoC in GitHub | 0xBlackash/CVE-2026-20253 | 2026-06-13 |
| PoC in GitHub | HORKimhab/CVE-2026-20253 | 2026-06-14 |
| PoC in GitHub | fevar54/CVE-2026-20253-Splunk-Enterprise-Pre-Auth-RCE- | 2026-06-26 |
| PoC in GitHub | pssec-io/CVE-2026-20253 | 2026-06-29 |
| PoC in GitHub | Het-Kalariya/CVE-2026-20253 | 2026-07-18 |
| PoC in GitHub | ivanesk315/CVE-2026-20253 | 2026-09-10 |
| Nuclei | Splunk Enterprise & Cloud Platform - Unrestricted File Upload |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-20253 is a critical vulnerability (CVSS 9.8) in Splunk Enterprise, published June 10, 2026. CISA lists it as known to be exploited, since June 18, 2026. EUVD reports exploitation since June 18, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.9%, the 99th percentile. No source names a fixed version.
References
advisory.splunk.com/advisories/SVD-2026-0603
labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20253
nvd.nist.gov/vuln/detail/CVE-2026-20253
github.com/advisories/GHSA-xgm5-jh99-wc4v