What is CVE-2026-20253?
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.
Affected product
Splunk Enterprise
Remediation Steps
- Upgrade Splunk Enterprise to version 10.2.4 or 10.0.7 or later
- If immediate upgrade is not possible, restrict network access to Splunk Enterprise instances to trusted internal networks only
- Review authentication and authorization logs for suspicious unauthenticated file operations
- Apply vendor security updates as soon as they become available
References
Coverage on defend.network
🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.