A missing authentication control on Splunk's PostgreSQL sidecar service endpoint lets any network-reachable, unauthenticated attacker create or truncate arbitrary files on affected systems.
What Is It
CVE-2026-20253 is a critical vulnerability in Splunk Enterprise and Splunk Cloud Platform. The PostgreSQL sidecar service endpoint lacks authentication controls, so any network-reachable user can invoke file operations without credentials. This allows an unauthenticated attacker to create or truncate arbitrary files on the host. The issue is classified as CWE-306 (Missing Authentication for a Critical Function) and carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Why It Matters
The flaw is remotely exploitable over the network, requires low attack complexity, needs no privileges, and requires no user interaction. With high impact across confidentiality, integrity, and availability, arbitrary file creation or truncation by an unauthenticated actor can corrupt data, disrupt service, or serve as a foothold for further compromise. Splunk deployments are frequently central to security and log infrastructure, raising the stakes of an exposed, unauthenticated endpoint.
What's Vulnerable
The following versions are affected:
- Splunk Enterprise below 10.2.4 and below 10.0.7
- Splunk Cloud Platform below 10.4.2604.3 and below 10.2.2510.14
The root cause is the PostgreSQL sidecar service endpoint shipping without authentication controls.
Patch Status
Fixed releases are available. Upgrade Splunk Enterprise to 10.2.4 or 10.0.7 (or later) and ensure Splunk Cloud Platform is at 10.4.2604.3 or 10.2.2510.14 (or later). At the time of this record, the NVD entry is "Undergoing Analysis," and no CISA KEV entry confirming active exploitation was supplied. Refer to the Splunk advisory for full remediation guidance.
Sources
- Splunk Security Advisory SVD-2026-0603; https://advisory.splunk.com/advisories/SVD-2026-0603
- NVD: CVE-2026-20253; https://nvd.nist.gov/vuln/detail/CVE-2026-20253