Splunk CVE-2026-20253: Unauthenticated Postgres Sidecar Flaw

What to do

1. Run $SPLUNK_HOME/bin/splunk version on every Splunk Enterprise host and list those on 10.0 or 10.2.
2. Upgrade to the October 2026 releases (10.4.4, 10.2.8 or 10.0.11); at minimum reach 10.2.4 or 10.0.7.
3. If you cannot upgrade yet and do not use Edge Processor, OpAmp or SPL2 pipelines, disable the sidecar with [postgres] disabled = true in $SPLUNK_HOME/etc/system/local/server.conf and restart.
4. Limit Splunk Web to administrator and analyst networks; do not publish it to the internet.
5. If an affected instance was reachable and unpatched after June 10, treat it as an incident: rebuild it and rotate its credentials and tokens.

How to check if you are affected or compromised

• Search Splunk and reverse-proxy logs for requests to /splunkd/__raw/v1/postgres/recovery/backup or /restore, especially with ../ or hostaddr=, dbname=, port= or passfile= values.
• Look for pg_dump or pg_restore started by Splunk, dump files in odd locations, and outbound connections from Splunk to unknown PostgreSQL servers.
• Check apps/splunk_secure_gateway/bin/ssg_enable_modular_input.py and other app scripts for changes; run splunk validate files to compare against the shipped manifest.

What happened#

On June 10, 2026, Splunk published SVD-2026-0603 for CVE-2026-20253, a missing-authentication flaw (CWE-306) in Splunk Enterprise 10.0 and 10.2. A PostgreSQL sidecar service endpoint performs file operations without checking who is asking. Any network-reachable user can create or truncate arbitrary files. Splunk rates it CVSS 3.1 9.8 on the CVE record, with Cisco as the CNA. It fixed the bug in 10.4.0, 10.2.4 and 10.0.7 and credits Alex Hordijk.

On June 12, watchTowr Labs showed how far it goes. The sidecar listens only on loopback ports such as 127.0.0.1:5435. Splunk Web still proxies requests to it through paths like /en-US/splunkd/__raw/v1/postgres/recovery/backup. The backup and restore endpoints pass attacker input to pg_dump and pg_restore. One parameter can point at a local .pgpass file that holds a postgres_admin credential. The researchers turned that into arbitrary file writes as the splunk user. They then overwrote ssg_enable_modular_input.py, a script Splunk runs frequently, to get code execution. They found the sidecar installed and enabled by default on Splunk Enterprise on AWS, but not active by default on their manual on-premises installs.

On June 18, Splunk updated the advisory to say it knew of "limited exploitation." CISA added the CVE to KEV that day with a June 21 deadline, citing BOD 26-04 and its forensic triage requirements. Resecurity said on June 16 that it was tracking exploitation. Neither named an actor. Who was behind it was not disclosed as of Oct 23, 2026.

Who is affected#

Splunk Enterprise 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6 with the sidecar running. Versions 9.4 and earlier are not affected. Splunk says Cloud Platform does not use the sidecar and is not affected. NVD carries the same 9.8 score.

Do you really need to act?#

If you upgraded in June, your main job is to confirm that and keep going. A newer advisory, SVD-2026-1008 from October 21, 2026, fixes issues rated up to 9.9 in 10.4.4, 10.2.8, 10.0.11 and 9.4.16. So 10.2.4 or 10.0.7 is no longer enough. Hunting matters because Splunk is where defenders look for attacks. Resecurity notes that a compromised platform "can significantly reduce organizational visibility." Horizon3.ai and Help Net Security also say the file write can lead to code execution.

What to do now#

1. Run $SPLUNK_HOME/bin/splunk version on each host.
2. Upgrade to 10.4.4, 10.2.8 or 10.0.11.
3. If you must wait, add [postgres] with disabled = true to $SPLUNK_HOME/etc/system/local/server.conf and restart. Splunk warns this breaks Edge Processor, OpAmp and SPL2 pipelines.
4. Keep Splunk Web off the internet.
5. Rebuild any affected instance that was reachable and unpatched after June 10, and rotate its credentials.

How to tell if you were hit#

• Run grep -rE 'v1/postgres/recovery/(backup|restore)' $SPLUNK_HOME/var/log/splunk/ and check proxy logs for the same paths. Look closely at requests with ../, hostaddr=, dbname= or passfile=.
• Look for pg_dump or pg_restore launched by Splunk, dump files in unusual places, and connections to unknown PostgreSQL servers.
• Run splunk validate files and inspect splunk_secure_gateway/bin/ssg_enable_modular_input.py.

Timeline#

• Jun 10, 2026 — Splunk publishes SVD-2026-0603 and fixed releases.
• Jun 12, 2026 — watchTowr publishes the RCE chain; Splunk clarifies Cloud is not affected.
• Jun 16, 2026 — Resecurity reports it is tracking exploitation.
• Jun 18, 2026 — Splunk confirms limited exploitation; CISA adds the CVE to KEV.
• Oct 21, 2026 — Splunk ships 10.4.4, 10.2.8, 10.0.11 and 9.4.16 with further critical fixes.

Vulnerability records

• CVE-2026-20253 · KEV 2026-06-18 · In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Splunk — SVD-2026-0603: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise advisory.splunk.com
2. Splunk — SVD-2026-1008: Security Hardening in Splunk Enterprise, October 2026 advisory.splunk.com
3. CVE record — CVE-2026-20253 cve.org
4. NVD — CVE-2026-20253 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-20253 cisa.gov
6. watchTowr Labs — Why Use App-Level Auth When Every Database Has Auth? Splunk Enterprise CVE-2026-20253 Pre-Auth RCE labs.watchtowr.com
7. Resecurity — CVE-2026-20253: Splunk Enterprise Pre-Authentication Remote Code Execution resecurity.com
8. Horizon3.ai — CVE-2026-20253 horizon3.ai

Coverage and analysis

1. Help Net Security — Unauthenticated RCE in Splunk Enterprise under active attack (CVE-2026-20253) helpnetsecurity.com