Splunk Enterprise Pre-Authentication Remote Code Execution Vulnerability

Resecurity has identified a critical vulnerability, CVE-2026-20253, impacting Splunk Enterprise and Splunk Cloud Platform. The flaw exists in the PostgreSQL Sidecar Service, which is responsible for database backup and recovery. Unauthenticated attackers can exploit exposed API endpoints to perform arbitrary file writes, eventually leading to full system compromise.

The vulnerability is particularly severe because it requires no valid credentials or user interaction. Attackers can force the service to connect to malicious external PostgreSQL servers and use subsequent 'restore' operations to execute malicious SQL and overwrite application scripts. Splunk Enterprise deployments on AWS are notably vulnerable by default as the Sidecar Service is pre-installed and enabled.

Successful exploitation grants attackers full control over the Splunk environment, potentially exposing sensitive security logs, identity records, and operational telemetry. Organizations should prioritize upgrading to fixed versions (Splunk Enterprise 10.0.7, 10.2.4, or 10.4.0) and restrict access to management interfaces.