CVE-2026-20253: Splunk Enterprise missing authentication on PostgreSQL sidecar endpoint (CVSS 9.8, KEV)
An unauthenticated, network-reachable user can create or truncate arbitrary files through a PostgreSQL sidecar endpoint in Splunk Enterprise 10.0.0–10.0.6 and 10.2.0–10.2.3. CISA added it to KEV on 2026-06-18 (federal due date 2026-06-21).
Patch to 10.0.7 / 10.2.4 / 10.4.0+ and get Splunk Web off any broad network path. If you can't patch, Splunk's workaround is disabling the Postgres sidecar (breaks Edge Processor, OpAmp and SPL2 pipelines). If you were exposed before patching, hunt: a compromised SIEM can blind you. Full write-up in Field Notes.
Splunk advisory SVD-2026-0603 (published 2026-06-10) describes missing authentication (CWE-306) on a PostgreSQL sidecar service endpoint in Splunk Enterprise 10.0.0–10.0.6 and 10.2.0–10.2.3. Any network-reachable user can create or truncate arbitrary files without credentials. Splunk rates it CVSS 3.1 9.8 Critical. Splunk Enterprise 9.4 and earlier, 10.4, and Splunk Cloud Platform are not affected.
Fixed versions are 10.0.7, 10.2.4 and 10.4.0. The vendor workaround is to add [postgres] disabled = true to $SPLUNK_HOME/etc/system/local/server.conf and restart. Don't use it on instances running Edge Processor, OpAmp or SPL2 data pipelines.
Splunk PSIRT reported limited exploitation in June 2026, and CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-06-18. watchTowr Labs published research on 2026-06-12 chaining the flaw into pre-authentication remote code execution through Splunk Web.
Detection and hunting guidance: /blog/cve-2026-20253-reading-the-advisory-before-you-panic