CVE-2026-20253: Splunk Enterprise PostgreSQL sidecar missing authentication allows file writes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, KEV-listed with a three-day federal remediation deadline, and EPSS near 0.97 make this an urgent patch.

What it is

Splunk Enterprise 10.2 below 10.2.4 and 10.x below 10.0.7 expose a PostgreSQL sidecar service endpoint that lacks authentication controls. Any network-reachable user can invoke file operations without credentials, creating or truncating arbitrary files. Versions 9.4 and earlier are not affected.

Impact

An unauthenticated attacker can create or truncate arbitrary files on the host, which can corrupt data or enable further compromise such as code execution depending on what files are writable. The CVSS vector rates confidentiality, integrity and availability all High.

Attack surface

Reached over the network via the PostgreSQL sidecar service endpoint; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. Any host that can reach the exposed endpoint qualifies as an attack path.

Exploitation

CISA added it to KEV on 2026-06-18 with a remediation due date of 2026-06-21, and EPSS gives a 30-day probability of 0.96939 (99.887th percentile). A third-party advisory is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Splunk Enterprise to 10.2.4 or later, or 10.0.7 or later, per the vendor advisory SVD-2026-0603.
• If immediate upgrade is not possible, disable the PostgreSQL sidecar service as the vendor directs.
• Restrict network access to the PostgreSQL sidecar endpoint so only trusted hosts can reach it.
• Treat any internet-exposed Splunk Enterprise instance as compromised until triaged, given KEV listing and high EPSS.
• Verify no unauthorized files were created or truncated on affected hosts before restoring service.

Detection

• Audit file creation and truncation events on Splunk Enterprise hosts for paths outside normal Splunk write activity.
• Monitor network connections to the PostgreSQL sidecar service port from unexpected or external sources.
• Review Splunk Enterprise and PostgreSQL sidecar logs for unauthenticated requests to file operation endpoints.
• Check for unexpected changes to configuration or binary files that could indicate tampering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.