Splunk Enterprise Critical Flaw: Pre-Auth RCE via PostgreSQL

Splunk has patched CVE-2026-20253, a critical pre-authentication remote code execution vulnerability in Splunk Enterprise's PostgreSQL sidecar service. Rated 9.8 on the CVSS scale, the flaw affects Splunk Enterprise versions prior to 10.0.7 and 10.2.4. Splunk Cloud Platform is unaffected.

The vulnerability chain is particularly dangerous because it requires no authentication. The PostgreSQL sidecar service endpoint lacks proper access controls, allowing any network-reachable attacker to invoke file operations without credentials. Security researchers at watchTowr Labs demonstrated that this could be chained into full pre-authentication remote code execution by writing malicious files to Splunk's script directories or configuration paths.

Beyond RCE, the vulnerability enables file truncation — effectively allowing attackers to zero out Splunk indexes, configuration files, or log data. For organizations relying on Splunk as their SIEM (Security Information and Event Management) backbone, this means an attacker could not only take control of the system but also destroy the forensic evidence needed to investigate the breach.

The vulnerability was disclosed alongside three additional high-severity flaws affecting Splunk Enterprise, Splunk Cloud Platform, and the Splunk Secure Gateway app, including stored cross-site scripting and server-side request forgery issues. Organizations running Splunk Enterprise on-premises should patch immediately to 10.0.7 or 10.2.4 and audit their PostgreSQL sidecar configurations.

This disclosure underscores a broader pattern in enterprise security: the most damaging vulnerabilities are increasingly found in auxiliary services and sidecar components rather than in core application code.