CVE-2026-20253

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-20253 9.8

Splunk · Enterprise · Added 2026-06-18 · Published 2026-06-10

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilitySplunk Enterprise Missing Authentication for Critical Function Vulnerability

VendorSplunk

ProductEnterprise

Date added2026-06-18

Due date2026-06-21

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-306

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-27 14:30 UTC

Wall time45.0s

Searches18

Component defaultno (manual Linux installs); yes (AWS deployments)

Sources https://github.com/watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253
https://github.com/0xBlackash/CVE-2026-20253
https://github.com/advisories/GHSA-xgm5-jh99-wc4v
https://orca.security/resources/blog/cve-2026-20253-splunk-enterprise-rce-unauthenticated-file-operations/
https://www.netspi.com/blog/executive-blog/critical-vulnerability/cve-2026-20253-splunk-enterprise-overview-and-takeaways/
https://www.picussecurity.com/resource/blog/splunk-cve-2026-20253-unauthenticated-remote-code-execution-vulnerability-explained
https://advisory.splunk.com/advisories/SVD-2026-0603
https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20253

Hunting hypothesis agent

Hunt Splunk web logs for POST /en-US/splunkd/__raw/v1/postgres/recovery/backup with path-traversal in backupFile or hostaddr= in database param — these reach the PostgreSQL sidecar RCE chain.

Research details

ComponentPostgreSQL sidecar service /v1/postgres/recovery/backup and /v1/postgres/recovery/restore endpoints (proxied via /en-US/splunkd/__raw/)

PreconditionsNetwork reachability to Splunk Enterprise web interface (port 8000/tcp) on affected versions (10.0.0-10.0.6, 10.2.0-10.2.3). PostgreSQL sidecar must be enabled (default on AWS; not default on manual installs). No authentication required — the endpoint accepts any credentials via HTTP Basic auth (even empty Basic Og==). For full RCE chain: attacker needs to deploy a PostgreSQL database accessible from the Splunk host (for hostaddr smuggling) and exploit pg_restore's lo_export for arbitrary file write. Splunk Cloud NOT affected. agent

DeliveryFour-stage chain: (1) POST /en-US/splunkd/__raw/v1/postgres/recovery/backup with path-traversal backupFile, (2) database param smuggles hostaddr to attacker DB, (3) POST /v1/postgres/recovery/restore with passfile pointing to local .pgpass, (4) pg_restore lo_export writes attacker Python to ssg_enable_modular_input.py

Public PoCyes

PoC URLs https://github.com/watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253
https://github.com/0xBlackash/CVE-2026-20253
https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/ Third-party repos; verify before use.

Advisoryhttps://advisory.splunk.com/advisories/SVD-2026-0603

Exploit notesCVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Four-stage pre-auth RCE chain (watchTowr Labs full writeup + PoC): 1. Path traversal in /v1/postgres/recovery/backup via backupFile param (e.g. ../../../../tmp/pwn) → arbitrary empty file write (pg_dump -f writes an empty file when DB auth fails) 2. PostgreSQL connection string smuggling via database param (hostaddr=attacker.db dbname=testdb) → overrides hardcoded -h localhost, forces Splunk to connect to attacker-controlled DB 3. /v1/postgres/recovery/restore loads malicious backup → pg_restore replays SQL via lo_export() function to write arbitrary file content to Splunk filesystem 4. Overwrite /opt/splunk/etc/apps/splunk_secure_gateway/bin/ssg_enable_modular_input.py with Python payload → RCE as splunk user when script is next executed Key technical details from watchTowr: - pg_dump -U takes the HTTP Basic auth username, -w never prompts for password - .pgpass file at /opt/splunk/var/packages/data/postgres/.pgpass contains postgres_admin credentials - pg_restore passfile param smuggled to read local .pgpass for database auth - backup endpoint proxied through main Splunk web UI via /en-US/splunkd/__raw/v1/postgres/recovery/backup - HTTP Basic auth accepts ANY credentials (empty Basic Og== = base64 of ':') - Splunk Cloud NOT affected (no Postgres sidecar) Mitigation: set [postgres] disabled = true in server.conf (breaks Edge Processor, OpAmp, SPL2 features).

SummaryCVE-2026-20253 is a critical pre-authentication RCE vulnerability (CWE-306, CVSS 9.8) in Splunk Enterprise 10.0.0-10.0.6 and 10.2.0-10.2.3. The PostgreSQL sidecar service endpoints (/v1/postgres/recovery/backup and /restore), proxied through the main Splunk web UI on port 8000, lack authentication controls and accept any credentials. watchTowr Labs demonstrated a four-stage RCE chain: path-traversal empty file write, PostgreSQL connection-string smuggling via the database parameter to connect to an attacker-controlled DB, pg_restore with lo_export for arbitrary file write using credentials from the local .pgpass file, and Python script overwrite for code execution. Splunk Cloud is NOT affected. Added to CISA KEV June 18, 2026.

Tia coverage

First reported2026-06-16

First exploit report2026-06-19

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

splunk-enterprise-cve-2026-20253-unauthenticated-rce-cvss-9-8

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.