CVE-2026-20253: Splunk Enterprise PostgreSQL Sidecar Unauthenticated RCE Mass-Exploited in the Wild

CVE-2026-20253 is unauthenticated RCE in Splunk Enterprise 10.x PostgreSQL Sidecar, CVSS 9.8. PoC landed 6 days before in-the-wild use; CISA added it to KEV.

Incident overview

CVE-2026-20253 is unauthenticated RCE in Splunk Enterprise PostgreSQL Sidecar. CVSSv3.1 9.8 (Critical), CWE-306 (Missing Authentication for Critical Function). Disclosed 10 June 2026 by QiAnXin CERT with watchTowr Labs. Full PoC and analysis published 12 June. Splunk confirmed in-the-wild exploitation on 18 June; CISA added it to KEV the same day and required federal agencies to patch by 21 June. Splunk Enterprise is a core SIEM. Compromise lets attackers tamper logs, disable alerts, steal all log data, and pivot.

Technical details

Affected products

• Splunk Enterprise 10.0.0 ~ 10.0.6: upgrade to 10.0.7

• Splunk Enterprise 10.2.0 ~ 10.2.3: upgrade to 10.2.4

• Splunk Enterprise 10.4.0+: not affected

• Splunk Enterprise 9.4.x and earlier: not affected

• Splunk Cloud Platform: not affected

Mechanism

Splunk Enterprise 10.x introduced PostgreSQL Sidecar to back Edge Processor, OpAmp, SPL2, and other data pipelines. Sidecar listens on `127.0.0.1:5435` and looks localhost-only, but Splunk Web's `splunkd/__raw` reverse-proxy path skips authentication and forwards public requests to Sidecar. Attackers send crafted HTTP POST requests to `/v1/postgres/recovery/backup` and `/v1/postgres/recovery/restore`, combining path traversal and PostgreSQL connection-string injection for unauthenticated RCE. Trigger chain:

• Anonymous request to `/en-US/splunkd/__raw/v1/postgres/recovery/backup` with `Authorization: Basic Og==` (empty username, empty password)

• Path traversal in `backupFile` (e.g. `../../../../../../tmp/poc`) to create/truncate files at arbitrary writable paths

• PostgreSQL connection-string injection to control `pg_dump/pg_restore` target hosts

• `passfile` parameter reads local `.pgpass` and exfiltrates credentials

• Arbitrary code execution as the Splunk process account

PoC and in-the-wild exploitation

watchTowr Labs released the `watchTowr DAG` detector on 12 June: HTTP 400 identifies unpatched instances; HTTP 401 means patched. QiAnXin Hunter mapping shows ~30661 exposed assets worldwide, 23296 related IPs. AWS deployments are hardest hit because PostgreSQL Sidecar is enabled by default. Splunk advisory SVD-2026-0603 rates the threat Critical and tells AWS users to check immediately.

Impact

Unauthenticated, network-reachable, no user interaction. Attack chain is stable and mass-replicable. Exploitation yields `splunk` user privileges: read all indexed data (auth logs, detection rules, investigation history), tamper audit trails, suppress alerts. Catastrophic for SOCs that rely on Splunk for detection. MITRE ATT&CK: `T1190` (Exploit Public-Facing Application), `T1059` (Command and Scripting Interpreter), `T1569.002` (System Services), `T1105` (Ingress Tool Transfer).

Remediation

Immediate patch

• Upgrade to Splunk Enterprise 10.0.7 / 10.2.4 / 10.4.0+. Official download: `https://www.splunk.com/zh_cn/download.html`

• If you cannot upgrade now: add `[postgres] disabled = true` in `$SPLUNK_HOME/etc/system/local/server.conf` and restart (only if Edge Processor, OpAmp, SPL2 are unused)

Mitigation and hardening

• Put Splunk Web default port 8000 behind a zero-trust access layer; block direct public access

• Block suspicious POST requests to `splunkd/__raw` on firewall/WAF

• Check `/tmp` and `/var/tmp` for anomalous file creation and `.pgpass` read logs

• Review Splunk process-account connections and command execution; hunt T1105 download payloads

• If compromised: rotate all admin accounts, check detection rules for tampering, rebuild affected index buckets

Sources

• Splunk SVD-2026-0603 official advisory

• watchTowr Labs technical analysis

• CISA BOD 26-04 mandatory patching directive