Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication
Splunk patched a critical unauthenticated flaw in Enterprise that can lead to arbitrary file writes and remote code execution. The bug is rated CVSS 9.8 and affects older 10.0.x and 10.2.x releases.
Intelligence analysis by GPT-5.4 Mini
Splunk has shipped fixes for CVE-2026-20253, a high-severity issue in a PostgreSQL sidecar endpoint that lets unauthenticated users trigger file operations. Researchers say the flaw can be chained into pre-auth remote code execution on vulnerable installs.
A locked door was missing its lock, and that let strangers make the machine write files it should not touch. From there, a thief could swap in a bad script, like slipping a fake note into a printer that later gets read and run.
Analysis
What happened
Splunk released security updates for CVE-2026-20253, a critical vulnerability in Splunk Enterprise rated 9.8 on the CVSS scale. The flaw affects versions below 10.2.4 and 10.0.7, while Splunk Enterprise 10.4 is not affected. Splunk Cloud is not impacted because it does not use Postgres sidecars.
How it works
According to Splunk, the vulnerable PostgreSQL sidecar service endpoint lacks authentication controls, which means a network-reachable user can invoke file operations without credentials. Security researchers at watchTowr Labs said the bug can be chained through the /v1/postgres/recovery/backup and /v1/postgres/recovery/restore endpoints.
Their write-up describes an attack path where an attacker uses the backup function to place a database dump on the Splunk file system, then uses restore with a passfile argument that points to Splunk’s .pgpass file. That file contains credentials for the postgres_admin user. Once the malicious dump is restored, SQL inside it can run against the local PostgreSQL instance.
Why the chain is dangerous
The researchers said the bug can be weaponized into an arbitrary file write by defining a function that uses lo_export, then causing that function to execute during restore. With file-write access, an attacker could overwrite a Python script that Splunk runs regularly and insert a payload that leads to remote code execution.
Current risk
There is no evidence in the article that the flaw is being exploited in the wild. Even so, the technical details are public now, which increases the chance of opportunistic attacks against unpatched systems. The practical takeaway is simple: affected Splunk Enterprise installations should move quickly to the fixed releases.
Key points
- Splunk fixed CVE-2026-20253, a critical unauthenticated flaw in Enterprise.
- Affected versions are below 10.2.4 and 10.0.7; Splunk 10.4 is not affected.
- watchTowr Labs said the bug can be chained through backup and restore endpoints.
- The chain can lead from arbitrary file write to remote code execution.
- Splunk Cloud is not affected because it does not use Postgres sidecars.
The patch closes the unauthenticated entry point before the flaw becomes widely abused. If administrators update quickly, they can remove the file-write and code-execution path described by researchers.
Unpatched Splunk Enterprise systems could be exposed to opportunistic attacks now that technical details are public. If an attacker reaches the vulnerable endpoint, the chain could end in file tampering and remote code execution.
