Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
Title source: cnaExploitation Summary
CVE-2026-20253 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 18, 2026. EIP tracks 6 public exploits from researchers including watchtowrlabs, Het-Kalariya, pssec-io. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a Python script that checks for the presence of CVE-2026-20253 by probing the `/v1/postgres/recovery/backup` endpoint in Splunk's PostgreSQL Sidecar Service. It does not exploit the vulnerability but detects potential exposure based on HTTP response codes.
Description
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
Exploits (6)
The repository contains a Python script that checks for the presence of CVE-2026-20253 by probing the `/v1/postgres/recovery/backup` endpoint in Splunk's PostgreSQL Sidecar Service. It does not exploit the vulnerability but detects potential exposure based on HTTP response codes.
This repository contains a full end-to-end exploit for CVE-2026-20253, an unauthenticated remote code execution vulnerability in Splunk Enterprise via the PostgreSQL recovery sidecar. The exploit chains a blank Basic auth bypass, arbitrary file write, and credential disclosure to achieve RCE as the 'splunk' service account.
This repository provides a functional exploit PoC for CVE-2026-20253, demonstrating an unauthenticated arbitrary file creation vulnerability in Splunk Enterprise via the PostgreSQL sidecar service. It includes Docker configurations for both vulnerable and patched instances, along with clear instructions for testing the vulnerability.
This repository contains a functional Python-based PoC for CVE-2026-20253, a pre-authentication RCE vulnerability in Splunk Enterprise. The exploit leverages unauthenticated access to PostgreSQL recovery endpoints to create arbitrary files and execute commands as the 'splunk' user.
The repository lacks functional exploit code for CVE-2026-20253 and instead contains a generic script for removing nested Git directories and a boilerplate README with no technical details about the vulnerability.
The repository contains a Python script that checks for the presence of vulnerable endpoints in Splunk Enterprise related to CVE-2026-20253. It does not exploit the vulnerability but scans for exposed endpoints that could lead to unauthenticated arbitrary file creation.
Nuclei Templates (1)
body="enterprise" && body="splunk"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H