Every CVESearch/Get API key

CVE-2026-20253

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

9.8 CriticalIn KEVPublic exploit

CVE-2026-20253 is a critical vulnerability (CVSS 9.8) in Splunk Enterprise, published June 10, 2026. CISA lists it as known to be exploited, since June 18, 2026. EUVD reports exploitation since June 18, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.9%, the 99th percentile. No source names a fixed version.

What does this mean?
Severity
9.8 CriticalCVSS 3.1, CVE List
Exploit chance
96.9%EPSS, 99th percentile
Exploitation
ExploitedCISA KEV,
Fixed in
No fix listedNo source names one

Description

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

96.9%Up 96.9 points since Jun 11, 2026
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubwatchtowrlabs/watchTowr-vs-Splunk-CVE-2026-202532026-06-12
PoC in GitHubashrafzaryouh/CVE-2026-202532026-06-13
PoC in GitHubHORKimhab/CVE-2026-202532026-06-14
PoC in GitHubfevar54/CVE-2026-20253-Splunk-Enterprise-Pre-Auth-RCE-2026-06-26
PoC in GitHubpssec-io/CVE-2026-202532026-06-29
PoC in GitHubHet-Kalariya/CVE-2026-202532026-07-18
PoC in GitHubNSK-394/owasp-nettacker-contribution2026-07-18
PoC in GitHubivanesk315/CVE-2026-202532026-09-10
NucleiSplunk Enterprise & Cloud Platform - Unrestricted File Upload

What each source reports

CVE List Score used9.8

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

Record
CVE-2026-20253
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
EUVDEUVD-2026-360889.8

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

Record
EUVD-2026-36088
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-xgm5-jh99-wc4v9.8

In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below...

In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.

Record
GHSA-xgm5-jh99-wc4v
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
CISA KEVNo score

Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.

Record
CVE-2026-20253
Weakness
CWE-306
Updated
2026-11-02
NVD9.8

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

Record
CVE-2026-20253
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02

History

History
RecordedChangedSources
exploitsPoC in GitHub
exploitsPoC in GitHub
exploitation, exploits
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open