CVE-2026-20253

The PostgreSQL sidecar service in Splunk Enterprise exposes a network endpoint that does not require authentication (CWE-306: Missing Authentication for Critical Function). Any user with network access to this endpoint can send requests that trigger file system operations — creating new files or truncating existing ones to zero length. The lack of access controls makes the attack possible without possessing any credentials in the system.

An attacker can create arbitrary files or destroy the contents of existing files on the server, which may lead to system disruption, deletion of critical configuration data, or — in combination with other techniques — remote code execution (RCE).

Update Splunk Enterprise to version 10.2.4 or later (for the 10.2 branch) or to version 10.0.7 or later (for the 10.0 branch). If immediate patching is not possible, the vendor recommends disabling the PostgreSQL sidecar service as a temporary workaround.

Splunk Enterprise in versions 10.2 below 10.2.4 and in versions 10.0 below 10.0.7. Versions 9.4 and earlier are not vulnerable.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.