Splunk Enterprise/Cloud Platform PostgreSQL Sidecar Service Endpoint missing authentication

Summaryinfo

A vulnerability, which was classified as critical, was found in Splunk Enterprise and Cloud Platform. This affects an unknown part of the component PostgreSQL Sidecar Service Endpoint. The manipulation results in missing authentication. This vulnerability was named CVE-2026-20253. The attack may be performed from remote. In addition, an exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Splunk Enterprise and Cloud Platform (affected version not known). Affected is some unknown functionality of the component PostgreSQL Sidecar Service Endpoint. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

The advisory is available at advisory.splunk.com. This vulnerability is traded as CVE-2026-20253 since 10/08/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but an exploit is available.

It is declared as attacked. This issue was added on 06/18/2026 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 06/21/2026:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO

Upgrading eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Cloud Platform
• Enterprise

License

• commercial

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion