Splunk Enterprise Unauthenticated Arbitrary File Creation and RCE via PostgreSQL Sidecar Service (CVE-2026-20253)

1. Apply Official Security Patches

Upgrade your Splunk Enterprise instances to the fixed versions as recommended by the vendor:

• For 10.2.x deployments: Upgrade to 10.2.4 or higher
• For 10.0.x deployments: Upgrade to 10.0.7 or higher

2. Temporary Mitigation (Workaround)

If you cannot immediately upgrade to a patched version, mitigate the risk by disabling the PostgreSQL sidecar service.

# Stop the Splunk service before making configuration changes
./splunk stop

# Restrict network access to the PostgreSQL sidecar service port (e.g., port 5432) using host firewalls
iptables -A INPUT -p tcp --dport 5432 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -j DROP

This vulnerability (CVE-2026-20253) arises from a Missing Authentication for Critical Function (CWE-306) within the PostgreSQL sidecar service endpoint in Splunk Enterprise.

Because the endpoint lacks proper authentication controls, any network-reachable attacker can invoke file operations without providing credentials. This allows attackers to create or truncate arbitrary files on the host system. By leveraging this capability, an attacker can write malicious payloads (such as web shells) or overwrite critical configuration files to achieve arbitrary code execution under the context of the Splunk process. This vulnerability has been assigned a CVSS score of 9.8 (Critical) and is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog.