cbcvebase.
CVE-2026-20253
published 2026-06-10

CVE-2026-20253: In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a…

PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-06-21
Exploited in the wild
EPSS
96.94%
99.9th percentile
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

Affected

4 ranges
VendorProductVersion rangeFixed in
splunksplunk>= 10.0.0 < 10.0.710.0.7
splunksplunk>= 10.2.0 < 10.2.410.2.4
splunksplunk_enterprise>= 10.0 < 10.0.710.0.7
splunksplunk_enterprise>= 10.2 < 10.2.410.2.4

Detection & IOCsextracted from sources · hover to see the quote

url/v1/postgres/recovery/backup
url/v1/postgres/recovery/restore
path/opt/splunk/var/packages/data/postgres/.pgpass
path/opt/splunk/etc/apps/splunk_secure_gateway/bin/ssg_enable_modular_input.py
commandPOST /{{region}}/splunkd/__raw/v1/postgres/recovery/backup HTTP/1.1
otherAuthorization: Basic ZGFnOg==
sigma
from logs-network_traffic.http*, logs-zeek.http*, logs-suricata.eve*
| where http.request.method == "POST"
and (
  url.path like "*splunkd/__raw/v1/postgres/recovery/*" or
  url.path like "/v1/postgres/recovery/*"
)
| eval Esql.is_backup = case(url.path like "*/backup", 1, 0)
| eval Esql.is_restore = case(url.path like "*/restore", 1, 0)
| stats
  Esql.backup_count = SUM(Esql.is_backup),
  Esql.restore_count = SUM(Esql.is_restore),
  Esql.first_seen = MIN(@timestamp),
  Esql.last_seen = MAX(@timestamp),
  Esql.statuses = VALUES(http.response.status_code)
  by source.ip, destination.ip
| eval Esql.duration_minutes = DATE_DIFF("minute", Esql.first_seen, Esql.last_seen)
| where Esql.backup_count >= 1 and Esql.restore_count >= 1
  and Esql.duration_minutes <= 15
| keep source.ip, destination.ip, Esql.*
sigma
http.request.method:POST and
url.path:("*splunkd/__raw/v1/postgres/recovery/*" or "/v1/postgres/recovery/*") and
(
  http.request.body.content:(
    "*\"backupFile\"*../*" or
    "*\"backupFile\"*/dev/shm/*" or
    "*\"backupFile\"*/etc/cron*" or
    "*\"backupFile\"*/home/*/.ssh/*" or
    "*\"backupFile\"*/opt/splunk/bin/scripts/*" or
    "*\"backupFile\"*/opt/splunk/etc/apps/*" or
    "*\"backupFile\"*/root/*" or
    "*\"backupFile\"*/tmp/*" or
    "*\"backupFile\"*/var/tmp/*" or
    "*\"backupFile\"*authorized_keys*" or
    "*\"database\"*dbname=*" or
    "*\"database\"*host=*" or
    "*\"database\"*hostaddr=*" or
    "*\"database\"*passfile=*" or
    "*\"database\"*password=*" or
    "*\"database\"*port=*" or
    "*\"database\"*service=*" or
    "*\"database\"*sslmode=*" or
    "*\"database\"*user=*" or
    "*/opt/splunk/etc/apps/*" or
    "*/opt/splunk/var/packages/data/postgres/.pgpass*"
  ) or
  data_stream.dataset:zeek.http and url.password:"" or
  data_stream.dataset:(azure.application_gateway or gcp.loadbalancing_logs or network_traffic.http or suricata.eve or zeek.http) and
  url.path:(
    "*splunkd/__raw/v1/postgres/recovery/backup" or
    "*splunkd/__raw/v1/postgres/recovery/restore" or
    /v1/postgres/recovery/backup or
    /v1/postgres/recovery/restore
  ) and
  http.response.status_code:400
)
  • Detect POST requests to the Splunk PostgreSQL sidecar recovery endpoints (backup and restore) — especially a backup followed by a restore from the same source IP to the same destination within 15 minutes, which matches the CVE-2026-20253 RCE chain.
  • Inspect HTTP request bodies to the recovery endpoints for PostgreSQL connection-string injection keywords (host=, hostaddr=, passfile=, password=, sslmode=, etc.) and suspicious backupFile destinations such as /tmp/, /dev/shm/, /etc/cron*, /root/, /home/*/.ssh/, authorized_keys, or paths under /opt/splunk/etc/apps/.
  • Flag HTTP 400 responses to the Splunk PostgreSQL recovery endpoints — the public Nuclei PoC probe returns a 400 'Failed to decode' response, indicating active scanning/exploitation attempts.
  • Alert on unauthenticated (empty-password) Basic auth credentials observed in HTTP requests to the Splunk PostgreSQL recovery endpoints, as used in public exploit tooling.
  • Monitor the Splunk file system for unexpected modifications to Python scripts under /opt/splunk/etc/apps/ — particularly ssg_enable_modular_input.py — which is the RCE pivot target described in the watchTowr exploit chain.
  • Watch for the presence or modification of the .pgpass file at /opt/splunk/var/packages/data/postgres/.pgpass, which is targeted by the exploit to extract the postgres_admin password and authenticate to the local PostgreSQL instance.
  • ·Disabling the PostgreSQL sidecar service removes the attack surface but breaks Edge Processor, OpAmp, and SPL2 data pipelines on affected instances.
  • ·Splunk Cloud Platform is not impacted because Postgres sidecars are not used in that product.
  • ·Splunk Enterprise versions 9.4 and earlier are not affected by this vulnerability.
  • ·Splunk Enterprise 10.4 is also not affected.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.