CVE-2026-20253

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.0 through 10.0.6 Splunk Enterprise versions 10.2 through 10.2.3

Description An unauthenticated user can create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. This occurs because the endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. This flaw can be leveraged to achieve pre-authentication remote code execution with Splunk-level privileges. Approximately 1,400 instances of the software are exposed to the internet, primarily in North America and Europe, and there have been reports of limited exploitation in real-world attacks.

Recommendations Update Splunk Enterprise versions 10.0 through 10.0.6 to version 10.0.7. Update Splunk Enterprise versions 10.2 through 10.2.3 to version 10.2.4. As a temporary workaround, disable the PostgreSQL sidecar service.