Critical Splunk Enterprise Flaw CVE-2026-20253 Enables Unauthenticated Remote Code Execution

Splunk has issued security updates to remediate a severe vulnerability in Splunk Enterprise that opens the door to unauthenticated file manipulation and potential remote code execution (RCE). The flaw, designated CVE-2026-20253, carries a near-maximum CVSS score of 9.8, reflecting its critical severity.

According to Splunk, versions below 10.2.4 and 10.0.7 of Splunk Enterprise are affected. The root cause lies in a PostgreSQL sidecar service endpoint that operates without any authentication controls — meaning any user with network access can invoke file operations freely, without supplying credentials. This exposes systems to arbitrary file creation or truncation attacks.

Splunk, now operating under the Cisco umbrella, confirmed that Splunk Cloud is unaffected, as it does not utilize PostgreSQL sidecar services.

Shortly after Splunk's disclosure, researchers Piotr Bazydlo and Yordan Ganchev from watchTowr Labs published a deeper technical breakdown, demonstrating how CVE-2026-20253 can be weaponized to achieve pre-authenticated RCE on vulnerable systems.

The attack targets two specific endpoints — /v1/postgres/recovery/backup and /v1/postgres/recovery/restore — and unfolds in stages:

1. An attacker crafts a malicious database dump that defines a custom PostgreSQL function leveraging lo_export — a built-in function that writes database BLOBs directly to the filesystem.


2. During the restore process, this function executes automatically, writing attacker-controlled content to an arbitrary file location.


3. With file-write access established, the attacker overwrites a Python script that Splunk routinely executes — such as /opt/splunk/etc/apps/splunk_secure_gateway/bin/ssg_enable_modular_input.py — injecting a malicious payload.


4. When Splunk next runs the tampered script, the attacker achieves full remote code execution.

"Once we could restore attacker-controlled SQL into the local PostgreSQL instance, we quickly put together a database dump template that gave us a controlled file write," the researchers noted.

Organizations running affected versions of Splunk Enterprise are strongly urged to apply the available patches without delay.