Critical Splunk Enterprise Flaw CVE-2026-20253 Allows Unauthenticated RCE via PostgreSQL Sidecar

Splunk has released urgent security updates to address a critical vulnerability in Splunk Enterprise, tracked as CVE-2026-20253, with a CVSS score of 9.8. The flaw allows unauthenticated attackers to perform arbitrary file operations and achieve remote code execution through a PostgreSQL sidecar service endpoint.

According to Splunk’s advisory, versions below 10.2.4 and 10.0.7 are affected. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, enabling any network-reachable user to invoke file operations without credentials. Splunk Cloud is not impacted as it does not use Postgres sidecars.

WatchTowr Labs published technical details on June 13, 2026, revealing that the flaw can be exploited via the “/v1/postgres/recovery/backup” and “/v1/postgres/recovery/restore” endpoints. The attack chain involves connecting to an attacker-controlled database, dumping its contents to an arbitrary file, then restoring the malicious dump to execute SQL queries that define a function using lo_export to write attacker-controlled content to the file system. This arbitrary file write can be escalated to remote code execution by overwriting a Python script that Splunk frequently executes.

On June 18, 2026, Splunk PSIRT confirmed limited exploitation of the vulnerability. CISA has added CVE-2026-20253 to its Known Exploited Vulnerabilities catalog, requiring FCEB agencies to apply fixes by June 21, 2026. Users are strongly advised to upgrade to Splunk Enterprise 10.0.7 or 10.2.4 immediately.