Splunk Enterprise PostgreSQL sidecar pre-auth arbitrary file write via unauthenticated recovery endpoint

CVE-2026-20253 is a missing-authentication flaw (CWE-306) in the PostgreSQL sidecar service bundled with Splunk Enterprise 10.0.0–10.0.6 and 10.2.0–10.2.3. The sidecar's recovery endpoints — /v1/postgres/recovery/backup and /v1/postgres/recovery/restore — are proxied through Splunk Web (port 8000) at /en-US/splunkd/__raw/v1/postgres/recovery/ and accept any Basic Authorization header, including empty credentials. An unauthenticated, network-reachable attacker can hit the backup endpoint with an unsanitized backupFile parameter to create or truncate arbitrary files on the host. The chain escalates to full RCE: the attacker injects a libpq connection string into the database parameter to redirect pg_dump to an attacker-controlled PostgreSQL server, then triggers the /restore endpoint to replay a crafted dump containing a PL/pgSQL function that calls lo_export to write a malicious Python script into splunk_secure_gateway/bin/ssg_enable_modular_input.py. On the next splunkd restart, that script executes as the splunk service account. An alternative chain documented by Miggo uses COPY TO PROGRAM during restore replay — no restart required. Splunk Enterprise 9.4 and earlier, and Splunk Cloud Platform, are not affected.

Splunk rated this CVSS 9.8 CRITICAL and that rating is accurate. This is a textbook pre-auth RCE against the platform most enterprises run as their SIEM/detection plane. The attack chain is short (two HTTP requests), fully public (watchTowr Labs published the PoC on June 12, two days after disclosure), and confirmed exploited in the wild (Splunk PSIRT updated SVD-2026-0603 on June 18; CISA added it to KEV the same day with a 3-day federal deadline). The only friction worth noting is that on Windows manual installs the sidecar is installed but disabled by default — however, on AWS deployments the sidecar is enabled out of the box, and on Linux installs using Edge Processor, OpAmp, or SPL2 pipelines it will also be active. We shave 0.2 points from the vendor score to reflect the Windows-default-off scenario, but the blast radius of owning a SIEM — access to every security log, stored LDAP/AD credentials, the ability to suppress alerts and blind the SOC, and a pivot point to every system that forwards telemetry — keeps this firmly at CRITICAL.

Sources.

1. Splunk Advisory SVD-2026-0603
2. NVD — CVE-2026-20253
3. HelpNetSecurity — Unauthenticated RCE in Splunk Enterprise under active attack
4. Resecurity — CVE-2026-20253 Pre-Auth RCE Analysis
5. SAFE Security — Full Attack Chain Walkthrough
6. The Hacker News — Critical Splunk Enterprise Flaw
7. Deepwatch — Public PoC Advisory
8. Splunk Sidecar Configuration Settings

Run this on your auditor workstation (not on the Splunk host). It probes the sidecar recovery endpoint from the network to check if the instance is vulnerable. Requires curl. Usage: bash check_cve_2026_20253.sh https://splunk.example.com:8000 — no special privileges needed, just network access to Splunk Web.

#!/usr/bin/env bash
# check_cve_2026_20253.sh — noisgate verifier for CVE-2026-20253
# Probes the PostgreSQL sidecar recovery endpoint on Splunk Enterprise.
# Returns: VULNERABLE / PATCHED / NOT_INSTALLED / UNKNOWN
# Usage:  bash check_cve_2026_20253.sh <SPLUNK_WEB_URL>
#   e.g.  bash check_cve_2026_20253.sh https://splunk.corp.local:8000

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <SPLUNK_WEB_URL>"
  echo "  e.g. $0 https://splunk.example.com:8000"
  exit 3
fi

BASE_URL="${1%/}"
PROBE_PATH="/en-US/splunkd/__raw/v1/postgres/recovery/status/0"
FULL_URL="${BASE_URL}${PROBE_PATH}"

echo "[*] noisgate CVE-2026-20253 verifier"
echo "[*] Target: ${FULL_URL}"
echo ""

# Send probe — follow redirects, ignore cert errors (self-signed common on Splunk)
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
  -k \
  -m 10 \
  -H "Authorization: Basic Og==" \
  "${FULL_URL}" 2>/dev/null || echo "000")

echo "[*] HTTP response code: ${HTTP_CODE}"
echo ""

case "${HTTP_CODE}" in
  400)
    echo "VULNERABLE"
    echo "[!] Sidecar is present and lacks authentication."
    echo "[!] HTTP 400 ('Failed to decode request') confirms unpatched sidecar."
    echo "[!] ACTION REQUIRED: Patch to 10.0.7 / 10.2.4 / 10.4.0 or disable sidecar."
    exit 1
    ;;
  401)
    echo "PATCHED"
    echo "[+] Sidecar responds with HTTP 401 — authentication is enforced."
    echo "[+] This instance appears to be running a patched version."
    exit 0
    ;;
  404)
    echo "NOT_INSTALLED"
    echo "[+] Sidecar endpoint returned HTTP 404 — sidecar is not installed or enabled."
    echo "[+] This instance is not vulnerable to CVE-2026-20253."
    exit 0
    ;;
  000)
    echo "UNKNOWN"
    echo "[?] Connection failed — target may be unreachable, firewalled, or not Splunk."
    exit 2
    ;;
  *)
    echo "UNKNOWN"
    echo "[?] Unexpected HTTP ${HTTP_CODE}. Manual investigation required."
    echo "[?] Check if a WAF or proxy is intercepting the request."
    exit 2
    ;;
esac