CVE-2026-20253
Splunk Enterprise: Mehrere Schwachstellen
Weakness classes (CWE)
CWE-306Base
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
cwe.mitre.org →
Reanalysis & status changes
Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.
- CVE Translated2026-07-23 09:10 UTC· nvd@nist.gov
- Translation: Title: Splunk Enterprise de Splunk, Description: En las versiones de Splunk Enterprise 10.2 anteriores a la 10.2.4 y las versiones 10 anteriores a la 10.0.7, un usuario no autenticado podría crear o truncar archivos arbitrarios a través de un endpoint del servicio sidecar de PostgreSQL. La vulnerabilidad existe porque el endpoint del servicio sidecar de PostgreSQL carece de controles de autenticación, lo que permite a cualquier usuario accesible por red invocar operaciones de archivo sin credenciales. Las versiones de Splunk Enterprise 9.4 y anteriores no se ven afectadas. Si no puede actualizar inmediatamente a una versión corregida, puede mitigar esta vulnerabilidad deshabilitando el servicio sidecar de PostgreSQL.
- Modified Analysis2026-06-18 20:48 UTC· nvd@nist.gov
- Reference Type: Cisco Systems, Inc.: https://advisory.splunk.com/advisories/SVD-2026-0603 Types: Vendor Advisory → Cisco Systems, Inc.: https://advisory.splunk.com/advisories/SVD-2026-0603 Types: Mitigation, Vendor Advisory
- Reference Type: CISA-ADP: https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/ Types: Exploit, Third Party Advisory
- Reference Type: CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20253 Types: US Government Resource
- CVE Modified2026-06-16 15:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
- Reference: https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/
- CVE Modified2026-06-15 22:16 UTC· psirt@cisco.com
- Description: In Splunk Enterprise versions below 10.2.4 and 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. → In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
- CVE Modified2026-06-15 21:16 UTC· psirt@cisco.com
- Description: In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. → In Splunk Enterprise versions below 10.2.4 and 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.
Description
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
Source: BSI
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
- https://advisory.splunk.com/advisories/SVD-2026-0601
- https://advisory.splunk.com/advisories/SVD-2026-0606
- https://advisory.splunk.com/advisories/SVD-2026-0609
- https://advisory.splunk.com/advisories/SVD-2026-0605
- https://advisory.splunk.com/advisories/SVD-2026-0603
- https://advisory.splunk.com/advisories/SVD-2026-0607
- https://advisory.splunk.com/advisories/SVD-2026-0608
- https://advisory.splunk.com/advisories/SVD-2026-0604
- https://advisory.splunk.com/advisories/SVD-2026-0602