---
title: "Splunk CVE-2026-20253: Unauthenticated Postgres Sidecar Flaw"
url: https://erroneo.us/security/briefs/splunk-enterprise-cve-2026-20253-postgres-sidecar/
description: "Pre-auth file write in Splunk Enterprise 10.0/10.2's PostgreSQL sidecar, chained to RCE and exploited in June. Move to the October 2026 releases."
type: security-brief
section: "Security Digest"
date_published: 2026-06-10
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-20253"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Splunk CVE-2026-20253: Unauthenticated Postgres Sidecar Flaw

**Verdict: Check exposure.** Patched since June and only 10.0 and 10.2 with the PostgreSQL sidecar enabled are exposed; confirm you are past the fix, preferably on the October 2026 releases, and hunt on any instance that sat unpatched with Splunk Web reachable.

- **Who must act:** Splunk Enterprise 10.0.0 to 10.0.6 and 10.2.0 to 10.2.3 deployments with the PostgreSQL sidecar enabled, starting with Splunk Enterprise on AWS, where it is on by default.
- **Who can relax:** Splunk Cloud Platform customers and Splunk Enterprise 9.4 and earlier, which are not affected by this bug, though 9.4 still needs the October 2026 fixes for other issues.
- **Affected:** Splunk Enterprise 10.2.0 through 10.2.3; Splunk Enterprise 10.0.0 through 10.0.6
- **Fixed:** Splunk Enterprise 10.4.0, 10.2.4, 10.0.7 (Jun 10, 2026); Now: 10.4.4, 10.2.8, 10.0.11 or 9.4.16 (Oct 21, 2026) for later critical fixes
- **CVEs:** CVE-2026-20253
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run $SPLUNK_HOME/bin/splunk version on every Splunk Enterprise host and list those on 10.0 or 10.2.
2. Upgrade to the October 2026 releases (10.4.4, 10.2.8 or 10.0.11); at minimum reach 10.2.4 or 10.0.7.
3. If you cannot upgrade yet and do not use Edge Processor, OpAmp or SPL2 pipelines, disable the sidecar with [postgres] disabled = true in $SPLUNK_HOME/etc/system/local/server.conf and restart.
4. Limit Splunk Web to administrator and analyst networks; do not publish it to the internet.
5. If an affected instance was reachable and unpatched after June 10, treat it as an incident: rebuild it and rotate its credentials and tokens.

### How to check if you are affected

- Search Splunk and reverse-proxy logs for requests to /splunkd/__raw/v1/postgres/recovery/backup or /restore, especially with ../ or hostaddr=, dbname=, port= or passfile= values.
- Look for pg_dump or pg_restore started by Splunk, dump files in odd locations, and outbound connections from Splunk to unknown PostgreSQL servers.
- Check apps/splunk_secure_gateway/bin/ssg_enable_modular_input.py and other app scripts for changes; run splunk validate files to compare against the shipped manifest.

## What happened

On June 10, 2026, Splunk published [SVD-2026-0603](https://advisory.splunk.com/advisories/SVD-2026-0603) for CVE-2026-20253, a missing-authentication flaw (CWE-306) in Splunk Enterprise 10.0 and 10.2. A PostgreSQL sidecar service endpoint performs file operations without checking who is asking. Any network-reachable user can create or truncate arbitrary files. Splunk rates it CVSS 3.1 9.8 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-20253), with Cisco as the CNA. It fixed the bug in 10.4.0, 10.2.4 and 10.0.7 and credits Alex Hordijk.

On June 12, [watchTowr Labs](https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/) showed how far it goes. The sidecar listens only on loopback ports such as 127.0.0.1:5435. Splunk Web still proxies requests to it through paths like `/en-US/splunkd/__raw/v1/postgres/recovery/backup`. The backup and restore endpoints pass attacker input to `pg_dump` and `pg_restore`. One parameter can point at a local `.pgpass` file that holds a `postgres_admin` credential. The researchers turned that into arbitrary file writes as the `splunk` user. They then overwrote `ssg_enable_modular_input.py`, a script Splunk runs frequently, to get code execution. They found the sidecar installed and enabled by default on Splunk Enterprise on AWS, but not active by default on their manual on-premises installs.

On June 18, Splunk updated the advisory to say it knew of "limited exploitation." CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20253) that day with a June 21 deadline, citing BOD 26-04 and its forensic triage requirements. [Resecurity](https://www.resecurity.com/blog/article/cve-2026-20253-splunk-enterprise-pre-authentication-remote-code-execution) said on June 16 that it was tracking exploitation. Neither named an actor. Who was behind it was not disclosed as of Oct 23, 2026.

## Who is affected

Splunk Enterprise 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6 with the sidecar running. Versions 9.4 and earlier are not affected. Splunk says Cloud Platform does not use the sidecar and is not affected. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-20253) carries the same 9.8 score.

## Do you really need to act?

If you upgraded in June, your main job is to confirm that and keep going. A newer advisory, [SVD-2026-1008](https://advisory.splunk.com/advisories/SVD-2026-1008) from October 21, 2026, fixes issues rated up to 9.9 in 10.4.4, 10.2.8, 10.0.11 and 9.4.16. So 10.2.4 or 10.0.7 is no longer enough. Hunting matters because Splunk is where defenders look for attacks. Resecurity notes that a compromised platform "can significantly reduce organizational visibility." [Horizon3.ai](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20253/) and [Help Net Security](https://www.helpnetsecurity.com/2026/06/19/splunk-vulnerability-cve-2026-20253-exploited/) also say the file write can lead to code execution.

## What to do now

1. Run `$SPLUNK_HOME/bin/splunk version` on each host.
2. Upgrade to 10.4.4, 10.2.8 or 10.0.11.
3. If you must wait, add `[postgres]` with `disabled = true` to `$SPLUNK_HOME/etc/system/local/server.conf` and restart. Splunk warns this breaks Edge Processor, OpAmp and SPL2 pipelines.
4. Keep Splunk Web off the internet.
5. Rebuild any affected instance that was reachable and unpatched after June 10, and rotate its credentials.

## How to tell if you were hit

- Run `grep -rE 'v1/postgres/recovery/(backup|restore)' $SPLUNK_HOME/var/log/splunk/` and check proxy logs for the same paths. Look closely at requests with `../`, `hostaddr=`, `dbname=` or `passfile=`.
- Look for `pg_dump` or `pg_restore` launched by Splunk, dump files in unusual places, and connections to unknown PostgreSQL servers.
- Run `splunk validate files` and inspect `splunk_secure_gateway/bin/ssg_enable_modular_input.py`.

## Timeline

- Jun 10, 2026 — Splunk publishes SVD-2026-0603 and fixed releases.
- Jun 12, 2026 — watchTowr publishes the RCE chain; Splunk clarifies Cloud is not affected.
- Jun 16, 2026 — Resecurity reports it is tracking exploitation.
- Jun 18, 2026 — Splunk confirms limited exploitation; CISA adds the CVE to KEV.
- Oct 21, 2026 — Splunk ships 10.4.4, 10.2.8, 10.0.11 and 9.4.16 with further critical fixes.

## Sources

1. [Splunk — SVD-2026-0603: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise](https://advisory.splunk.com/advisories/SVD-2026-0603)
2. [Splunk — SVD-2026-1008: Security Hardening in Splunk Enterprise, October 2026](https://advisory.splunk.com/advisories/SVD-2026-1008)
3. [CVE record — CVE-2026-20253](https://www.cve.org/CVERecord?id=CVE-2026-20253)
4. [NVD — CVE-2026-20253](https://nvd.nist.gov/vuln/detail/CVE-2026-20253)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-20253](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20253)
6. [watchTowr Labs — Why Use App-Level Auth When Every Database Has Auth? Splunk Enterprise CVE-2026-20253 Pre-Auth RCE](https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/)
7. [Resecurity — CVE-2026-20253: Splunk Enterprise Pre-Authentication Remote Code Execution](https://www.resecurity.com/blog/article/cve-2026-20253-splunk-enterprise-pre-authentication-remote-code-execution)
8. [Horizon3.ai — CVE-2026-20253](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20253/)
9. [Help Net Security — Unauthenticated RCE in Splunk Enterprise under active attack (CVE-2026-20253)](https://www.helpnetsecurity.com/2026/06/19/splunk-vulnerability-cve-2026-20253-exploited/)

---
Source page: https://erroneo.us/security/briefs/splunk-enterprise-cve-2026-20253-postgres-sidecar/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt