CVE-2026-20253: Pre-Authentication RCE Flaw in Splunk Enterprise

Summary

Resecurity describes CVE-2026-20253 as a pre-authentication RCE in Splunk Enterprise’s PostgreSQL Sidecar Service, chaining unauthenticated recovery endpoints, path traversal and PostgreSQL restore behavior; fixes are listed for affected releases.

Key points

Resecurity says it is tracking exploitation, but provides no incident-specific evidence; the article separately reports that researchers demonstrated a proof of concept.
The described flaw involves unauthenticated PostgreSQL Sidecar backup and restore endpoints, with inadequate validation of file paths and database connection parameters.
An attacker-controlled backupFile value can enable path traversal, while manipulated PostgreSQL parameters can direct Splunk to connect to an attacker-controlled database server.
The article describes combining attacker-controlled database dumps with restore operations and stored PostgreSQL credentials to execute malicious SQL and overwrite files used by Splunk.
The article says Splunk Enterprise on AWS may have the Sidecar Service installed and enabled by default; manual Windows installations do not install it by default, and installations with the service require additional configuration.
Listed fixes include Splunk Enterprise 10.0.7 and 10.2.4, and Splunk Cloud Platform 10.2.2510.14 and 10.4.2604.3; the article also recommends monitoring recovery endpoints and unexpected pg_dump or pg_restore activity.

Article Details

Attack Vectors: Unauthenticated remote access to exposed Splunk PostgreSQL Sidecar Service backup and restore endpoints.
Path traversal through the attacker-controlled backupFile parameter to write files outside the intended backup directory.
Attacker-controlled PostgreSQL connection parameters used to make Splunk connect to a remote database and generate attacker-controlled dump content.
Abuse of the restore endpoint and credentials stored in Splunk's .pgpass file to execute attacker-controlled database operations.
Replacement of Splunk application scripts with attacker-controlled content, which runs when Splunk subsequently executes the modified script.
Defensive Notes: Upgrade affected Splunk Enterprise and Splunk Cloud Platform releases to the vendor-provided fixed versions.
Restrict Splunk Web, management interfaces, and recovery endpoints to trusted administrators and internal networks; review and remove unnecessary internet exposure.
Monitor recovery API requests, especially those containing path traversal sequences or PostgreSQL parameters such as hostaddr=, dbname=, and passfile=.
Investigate unexpected pg_dump or pg_restore execution, unusual dump-file creation, and outbound connections from Splunk services to unknown PostgreSQL servers.
Inspect Splunk applications, scripts, and configuration files for unauthorized changes; investigate suspected compromise and rotate accessible credentials and tokens.