Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

Summary

CVE	CVE-2026-20253
State	PUBLISHED
Assigner	cisco
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-06-10 18:16:40 UTC
Updated	2026-06-19 06:17:01 UTC
Description	In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

Risk And Classification

Primary CVSS: v3.1 9.8 CRITICAL from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.881710000 probability, percentile 0.997500000 (date 2026-07-12)

CISA KEV: Listed on 2026-06-18; due 2026-06-21; ransomware use Unknown

Problem Types: CWE-306 | CWE-306 The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	9.8	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	CNA	CVSS	9.8	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA Known Exploited Vulnerability

Vendor	Splunk
Product	Enterprise
Name	Splunk Enterprise Missing Authentication for Critical Function Vulnerability
Required Action	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes	https://advisory.splunk.com/advisories/SVD-2026-0603 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20253

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Splunk	Splunk	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Splunk	Splunk Enterprise	affected 10.2 10.2.4 custom	Not specified
CNA	Splunk	Splunk Enterprise	affected 10.0 10.0.7 custom	Not specified

References

Reference	Source	Link	Tags
advisory.splunk.com/advisories/SVD-2026-0603	[email protected]	advisory.splunk.com	Mitigation, Vendor Advisory
labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-en...	134c704f-9b21-4f2e-91b3-4a467353bcc0	labs.watchtowr.com	Exploit, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog	134c704f-9b21-4f2e-91b3-4a467353bcc0	www.cisa.gov	US Government Resource
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis
CISA Known Exploited Vulnerabilities catalog	CISA	www.cisa.gov	kev

Vendor Comments And Credit

Discovery Credit

CNA: Alex Hordijk (hordalex) (en)

Additional Advisory Data

Source	Time	Event
ADP	2026-06-18T00:00:00.000Z	CVE-2026-20253 added to CISA KEV

There are currently no legacy QID mappings associated with this CVE.