Critical Splunk Enterprise Flaw Exposes Pre-Auth File Write and RCE Path

Splunk issued urgent fixes for CVE-2026-20253, a critical CVSS 9.8 vulnerability in Splunk Enterprise that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to 10.4.0, 10.2.4, 10.0.7, 9.4.12, and 9.3.13 depending on branch, and Splunk said Splunk Cloud is not affected because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue.

Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port 8000, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse /v1/postgres/recovery/backup and /restore for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local .pgpass credentials, and PostgreSQL large-object export to gain arbitrary file write as the splunk user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including CVE-2026-20251 (CVSS 8.8) in the Splunk Secure Gateway app due to unsafe jsonpickle deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.