CVE-2026-20253: Splunk Enterprise auth bypass in PostgreSQL sidecar service

CVE-2026-20253 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-06-10

Splunk Enterprise and Splunk Cloud Platform, which are used for searching, monitoring, and analyzing machine-generated data, contain a security flaw in a background database service. An unauthorized person can remotely create or delete files on the server without needing a password. This could lead to a total system takeover, data loss, or significant operational disruption.

Technologies: Splunk Enterprise, Splunk Cloud Platform. Vendors: Splunk.

Quick answers

Is CVE-2026-20253 exploited in the wild?
Yes. CVE-2026-20253 is known to be exploited in the wild, first recorded on 18 June 2026. Treat it as urgent.
How severe is CVE-2026-20253?
Critical severity, with a CVSS score of 9.8, published 10 June 2026.
Which products and versions are affected?
Splunk Enterprise < 10.2.4, < 10.0.7, 10.2.x before 10.2.4, 10.0.x before 10.0.7; Splunk Cloud Platform < 10.4.2604.3, < 10.2.2510.14, before 10.4.2604.3, before 10.2.2510.14.
Is there a fix for CVE-2026-20253?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20253 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20253?
Check whether you run Splunk Enterprise or Splunk Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication for critical function vulnerability (CWE-306) exists in the PostgreSQL sidecar service endpoint of Splunk Enterprise and Splunk Cloud Platform. The endpoint fails to enforce authentication controls, allowing any network-reachable attacker to invoke file operations without credentials. Specifically, an attacker can create or truncate arbitrary files on the underlying filesystem. This capability can be leveraged to achieve remote code execution (RCE). The vulnerability affects Splunk Enterprise versions 10.0.x (before 10.0.7) and 10.2.x (before 10.2.4), as well as specific Splunk Cloud Platform versions. Users are advised to upgrade to fixed versions or mitigate the risk by disabling the PostgreSQL sidecar service.

Affected products

  • Splunk Splunk Enterprise 10.2.x before 10.2.4, 10.0.x before 10.0.7
  • Splunk Splunk Cloud Platform before 10.4.2604.3, before 10.2.2510.14

Timeline

  • 2026-06-10: disclosed: Initial CVE entry received from Cisco/Splunk
  • 2026-06-15: advisory: Vendor advisory published by Splunk
  • 2026-06-18: other: NVD publication date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.