Splunk Enterprise CVE-2026-20253: unauthenticated PostgreSQL sidecar file write becomes pre-auth RCE

What happened

Splunk Enterprise 10 added a PostgreSQL “sidecar” service. Its API had no authentication, so “any network-reachable user” could create or truncate arbitrary files. Splunk published advisory SVD-2026-0603 on 10 June 2026, rated it CVSS 9.8 and credited Alex Hordijk (Splunk).

The sidecar listens only on 127.0.0.1, but watchTowr showed that Splunk Web on port 8000 forwards requests to it, through paths such as /en-US/splunkd/__raw/v1/postgres/recovery/backup and .../recovery/restore. It chained the file write with a database restore to drop and run a Python script, and published the analysis on 12 June. watchTowr found the sidecar installed and enabled by default on Splunk Enterprise on AWS; on other installs it may be absent or installed but off (watchTowr).

Field Effect reports exploitation starting on 15 June (Field Effect). On 18 June Splunk updated its advisory to say it had become aware of “limited exploitation” (Splunk), and CISA added the CVE to KEV the same day with a due date of 21 June (CISA KEV). Shadowserver tracked more than 1,400 internet-exposed Splunk instances (Greenbone).

Am I affected?

Source: Splunk.

# Version
$SPLUNK_HOME/bin/splunk version

# Is the sidecar running? (from watchTowr)
ss -tupln | grep -i splunk-postgres
ls $SPLUNK_HOME/var/run/supervisor/pkg-run/ | grep pkg-postgres

# Requests to the sidecar's recovery API through Splunk Web
grep -h 'postgres/recovery' $SPLUNK_HOME/var/log/splunk/web_access.log* $SPLUNK_HOME/var/log/splunk/splunkd_access.log* 2>/dev/null

watchTowr published a non-exploiting checker, watchTowr-vs-Splunk-CVE-2026-20253, that reports whether /v1/postgres/recovery/backup is reachable without authentication (watchTowr; GitHub).

What to do now

1. Update to 10.2.4, 10.0.7 or 10.4.0 (Splunk).
2. If you cannot update today, disable the sidecar. In $SPLUNK_HOME/etc/system/local/server.conf, add a [postgres] stanza containing disabled = true, then restart Splunk. Do not do this on instances that use Edge Processor, OpAmp or SPL2 data pipelines; disabling PostgreSQL breaks them. Search, indexing and dashboards are not affected (Splunk).
3. Keep Splunk Web off the internet. The attack path runs through the web interface on port 8000 (watchTowr; Field Effect).
4. Hunt on any 10.x instance that was exposed after 10 June. Look for requests to postgres/recovery/backup or restore, new or changed files under $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/, changed Python scripts in app bin folders (watchTowr modified splunk_secure_gateway/bin/ssg_enable_modular_input.py in its test), and unusual processes run by the Splunk service account (watchTowr; Field Effect).

Sources

• Splunk advisory SVD-2026-0603 (CVE-2026-20253)
• watchTowr Labs: Splunk Enterprise CVE-2026-20253 pre-auth RCE
• watchTowr detection script on GitHub
• Field Effect: exploited Splunk vulnerability
• Greenbone: threat report June 2026
• CVE record: CVE-2026-20253
• CISA Known Exploited Vulnerabilities catalog