cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Critical Splunk Enterprise Flaw Could Enable Unauthenticated Remote Code Execution

· Original article ↗

Summary

CVE-2026-20253 lets unauthenticated users write or truncate files through Splunk Enterprise’s PostgreSQL sidecar. Researchers described a path to potential remote code execution; Splunk has released fixes, and Splunk Cloud is unaffected.

Key points

  • CVE-2026-20253 is rated 9.8 CVSS and affects Splunk Enterprise versions below 10.0.7 and 10.2.4.
  • The unauthenticated PostgreSQL sidecar endpoints can be used to create or truncate arbitrary files.
  • watchTowr Labs described chaining the backup and restore endpoints to load attacker-controlled SQL and write files.
  • Researchers outlined how overwriting a frequently executed Python script could lead to remote code execution.
  • Splunk Enterprise 10.0.7 and 10.2.4 contain fixes; version 10.4 is not affected.
  • Splunk Cloud is not affected. The article says there is no evidence of exploitation in the wild.

Article Details

Vulnerability Types
  • Unauthenticated arbitrary file creation or truncation
  • Remote code execution
Severity
Critical (CVSS 9.8)
Affected Versions
  • Splunk Enterprise 10.0.0 to 10.0.6
  • Splunk Enterprise 10.2.0 to 10.2.3
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1059.006 · PythonThe researchers describe overwriting a Python script executed by Splunk to achieve remote code execution.T1190 · Exploit Public-Facing ApplicationThe described attack abuses unauthenticated PostgreSQL sidecar backup and restore endpoints on susceptible Splunk Enterprise systems.

CVE

CVE-2026-20253Splunk has issued security updates for CVE-2026-20253, a critical flaw in Splunk Enterprise that could allow unauthenticated file operations and remote code execution through PostgreSQL sidecar endpoints.

People

Piotr BazydloA watchTowr Labs security researcher who described restoring attacker-controlled SQL and achieving a controlled file write.Yordan GanchevA watchTowr Labs security researcher who described restoring attacker-controlled SQL and achieving a controlled file write.

Vendors

SplunkSplunk has issued security updates for CVE-2026-20253, a critical flaw in Splunk Enterprise that could allow unauthenticated file operations and remote code execution through PostgreSQL sidecar endpoints.

Products

PostgreSQLSplunk has issued security updates for CVE-2026-20253, a critical flaw in Splunk Enterprise that could allow unauthenticated file operations and remote code execution through PostgreSQL sidecar endpoints.Splunk CloudSplunk Cloud is not impacted, and updates are available for affected releases.Splunk EnterpriseSplunk has issued security updates for CVE-2026-20253, a critical flaw in Splunk Enterprise that could allow unauthenticated file operations and remote code execution through PostgreSQL sidecar endpoints.

Related Articles