CVE-2026-20253: Splunk Enterprise PostgreSQL Sidecar Auth Bypass to RCE (KEV)

CVE-2026-20253 is a missing-authentication flaw in the PostgreSQL sidecar service bundled with Splunk Enterprise 10.0 and 10.2 that lets an unauthenticated, network-reachable attacker create or truncate arbitrary files on the host; researchers at WatchTowr Labs published a proof-of-concept chaining that file write into full remote code execution as the Splunk user, and Splunk's own PSIRT confirmed limited real-world exploitation before CISA added the CVE to its KEV catalog.

CVE-2026-20253 is a missing-authentication-for-critical-function vulnerability (CWE-306) in Splunk Enterprise. NVD's description states that "In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint," because "the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials" (NVD).

NVD lists only a Secondary CVSS v3.1 submission from source [email protected] (Splunk is a Cisco subsidiary, and Cisco PSIRT acts as its CNA): base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD's own vulnerability status is "Analyzed," but no NVD Primary CVSS metric has been published for this CVE, so that 9.8 figure is labelled not NVD-confirmed on this page (NVD).

Splunk's own advisory SVD-2026-0603 confirms the same 9.8/CVSS:3.1 score, lists the affected range as Enterprise 10.0.0-10.0.6 and 10.2.0-10.2.3 (fixed in 10.0.7, 10.2.4 and 10.4.0), and states that "in June 2026, the Splunk Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability." The advisory's workaround — adding [postgres]\ndisabled = true to server.conf — is explicitly flagged as breaking Edge Processor, OpAmp and SPL2 data-pipeline features if those are in use (Splunk Advisory SVD-2026-0603).

WatchTowr Labs' technical write-up documents turning the raw file-write primitive into code execution: by abusing PostgreSQL's lo_export function inside a malicious database dump that Splunk is tricked into restoring, researchers overwrote /opt/splunk/etc/apps/splunk_secure_gateway/bin/ssg_enable_modular_input.py — a script Splunk routinely executes — with attacker-controlled Python, achieving confirmed proof-of-concept code execution as the Splunk user (WatchTowr Labs).

CISA added CVE-2026-20253 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-18, with a required-action due date of 2026-06-21 — three days later — citing BOD 26-04 risk-based patching guidance; the catalog records known ransomware-campaign use as "Unknown" and forensic triage as not required. Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.96939 (99.888th percentile) — among the highest EPSS scores in this round, consistent with a published working RCE chain against exposed Splunk search heads and indexers (FIRST EPSS).

Any Splunk Enterprise instance on 10.0.0-10.0.6 or 10.2.0-10.2.3 should be upgraded to 10.0.7, 10.2.4 or 10.4.0 immediately; operators who cannot patch right away and do not use Edge Processor, OpAmp or SPL2 pipelines should disable the PostgreSQL sidecar as an interim mitigation.

• Missing authentication for critical function (CWE-306) in the PostgreSQL sidecar service endpoint of Splunk Enterprise 10.2 below 10.2.4 and 10.0 below 10.0.7, allowing unauthenticated arbitrary file create/truncate. — NVD
• NVD lists only a Secondary CVSS v3.1 score of 9.8 (critical) from source [email protected], vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD Primary metric is published, so the score is not NVD-confirmed. — NVD
• Splunk's advisory confirms CVSS 9.8, lists fixed versions 10.0.7/10.2.4/10.4.0, states Splunk PSIRT became aware of limited exploitation in June 2026, and gives a server.conf workaround that breaks Edge Processor/OpAmp/SPL2. — Splunk Advisory SVD-2026-0603
• Researchers chained the file-write into RCE by abusing PostgreSQL lo_export during a restored database dump to overwrite a Python script Splunk executes (ssg_enable_modular_input.py), achieving confirmed proof-of-concept code execution as the Splunk user. — WatchTowr Labs
• Added to the CISA KEV catalog on 2026-06-18, required-action due date 2026-06-21, known ransomware campaign use recorded as Unknown. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
• EPSS score is 0.96939 (99.888th percentile) as of 2026-10-28. — FIRST EPSS