VulnSocial
← Back to blog

CVE-2026-20253 – Critical Pre‑Auth RCE in Splunk Enterprise PostgreSQL Sidecar

Key takeaways

  • Critical pre‑authentication remote code execution in Splunk Enterprise (PostgreSQL sidecar).
  • CVSS 9.8 (vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
  • Affects Splunk Enterprise 10.2 < 10.2.4 and 10.0 < 10.0.7 (versions 9.4 and earlier are not affected).
  • Public PoC and active exploitation observed; CISA KEV inclusion.
  • Patch now or disable the sidecar service.

Overview

The flaw, identified as CVE-2026-20253, is a pre‑authentication vulnerability in the built‑in PostgreSQL sidecar service of Splunk Enterprise. The sidecar endpoint does not enforce any authentication, allowing any network‑reachable client to invoke file‑system operations. By chaining arbitrary file writes with the sidecar’s execution context, an attacker can achieve remote code execution (RCE) without valid credentials.

The vulnerability was publicly disclosed on 2026‑06‑10. A proof‑of‑concept (PoC) appeared on 2026‑06‑12, and by 2026‑06‑19 the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20253 to its Known Exploited Vulnerabilities (KEV) catalog, urging immediate remediation.

Technical Details

The PostgreSQL sidecar runs on the default PostgreSQL port (5432) and exposes a REST‑like endpoint that forwards SQL commands directly to the database engine. Because the endpoint lacks authentication (CWE‑306), an unauthenticated attacker can issue privileged SQL statements such as COPY or SELECT INTO to write arbitrary files on the host filesystem.

A typical exploitation chain:

  1. File Write – Use the COPY command to write a malicious script or shared object to a location that the sidecar process can execute.
COPY (SELECT 'malicious') TO PROGRAM '/tmp/malicious.sh';

  1. Trigger Execution – Invoke a sidecar operation that loads or runs the written file, achieving RCE under the Splunk process user.

  2. Post‑exploitation – The attacker now controls the Splunk host, can exfiltrate logs, or pivot to other services.

The vulnerability is tracked under CWE‑306 (Missing Authentication) and has a CVSS v3.1 base score of 9.8.

Severity & Impact

MetricValue
CVE IDCVE-2026-20253
CVSS9.8 (Critical)
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWECWE‑306
ImpactRemote code execution via unauthenticated file write

The high CVSS score reflects the ease of exploitation (network‑only, no authentication) and the severe impact (full system compromise).

Affected Products

  • Splunk Enterprise 10.2 versions earlier than 10.2.4
  • Splunk Enterprise 10.0 versions earlier than 10.0.7

Versions 9.4 and earlier are not affected. For the complete list of affected releases, see the CVE page.

What Security Teams Should Do Now

  • Monitor inbound traffic to the PostgreSQL sidecar port (5432) from untrusted networks.
  • Deploy IDS/IPS signatures that detect anomalous COPY … TO PROGRAM usage or unexpected file‑write patterns.
  • Verify that the sidecar service is not exposed to the internet; restrict access to localhost or trusted management subnets.
  • Audit the Splunk file system for newly created or modified files in directories writable by the sidecar (e.g., $SPLUNK_HOME/etc/).
  • Review Splunk logs for unusual sidecar activity or failed authentication attempts (even though the service does not require auth).

Remediation & Mitigation

  1. Patch – Upgrade to Splunk Enterprise 10.2.4 or later, or 10.0.7 or later. The vendor advisory provides the required download links.
  2. If immediate patching is not possible, disable the PostgreSQL sidecar service:
# Stop the sidecar service (example)
splunk stop splunkd-postgresql

# Or disable via configuration
sed -i 's/^enableSidecar = true/enableSidecar = false/' $SPLUNK_HOME/etc/splunk-launch.conf
  1. Restrict network access – Use firewall rules to allow only localhost or specific management IPs to reach port 5432.
  2. Audit the filesystem for suspicious files created after the vulnerability’s disclosure date.
  3. Rotate any credentials that may have been used by compromised sidecar processes, even though the flaw is pre‑auth.

Bottom Line

CVE-2026-20253 is a Critical pre‑authentication RCE flaw in Splunk Enterprise that is already being exploited in the wild and has been added to the CISA KEV list. Organizations must apply the vendor patch immediately or disable the PostgreSQL sidecar service and tighten network controls to block exploitation.

References