Splunk Enterprise Pre-Auth RCE via PostgreSQL Sidecar (CVE-2026-20253)

Metadata

Affected Target

Summary

CVE-2026-20253 is a critical unauthenticated RCE vulnerability in Splunk Enterprise arising from a missing authentication check on the PostgreSQL sidecar service endpoint /v1/postgres/recovery/backup. An unauthenticated attacker can reach this endpoint and exploit the PostgreSQL lo_export function to write arbitrary files to the OS, which can be chained to achieve remote code execution. A watchTowr PoC was published; exploitation spiked shortly after. CISA added to KEV on June 18, 2026 with a federal remediation deadline of June 21.

Vulnerability Details

Root Cause

The PostgreSQL sidecar service bundled with Splunk Enterprise exposes an unauthenticated HTTP endpoint at /v1/postgres/recovery/backup. This endpoint allows interaction with the PostgreSQL process without credentials, enabling the lo_export function to write attacker-controlled data to arbitrary filesystem paths. Written content can include a Splunk scripted input or SOAR playbook that triggers RCE when the Splunk process loads it.

Attack Vector

1. Send unauthenticated HTTP request to http://TARGET:8000/<region>/v1/postgres/recovery/backup.
2. Exploit lo_export to write a malicious file to a Splunk-loaded path.
3. Trigger Splunk to load the file → RCE as the Splunk service user.

Impact

Unauthenticated remote code execution as the Splunk service account. Splunk typically runs with broad filesystem access and may have credentials for integrated data sources (cloud APIs, databases, SIEMs).

Environment / Lab Setup

Target:   Splunk Enterprise 10.0.0–10.0.6 or 10.2.0–10.2.3, Linux
Attacker: Python 3 with requests

Proof of Concept

Detection Script

See watchTowr-vs-Splunk-CVE-2026-20253.py in this folder. Detection only — checks endpoint accessibility, does not exploit.

1
2
3

python3 watchTowr-vs-Splunk-CVE-2026-20253.py \
  -H http://TARGET:8000 \
  -r en-US

Expected Output (vulnerable)

[+] VULNERABLE - access to /v1/postgres/recovery/backup not blocked

Expected Output (patched)

[-] NOT VULNERABLE - access to /v1/postgres/recovery/backup blocked

Detection & Indicators of Compromise

1
2
3
4
5

grep "postgres/recovery/backup" /opt/splunk/var/log/splunk/web_access.log

find /opt/splunk/etc/apps -newer /opt/splunk/etc/apps/search -name "*.py" -o -name "*.sh"

grep "ExecProcessor" /opt/splunk/var/log/splunk/splunkd.log

Remediation

References

• CVE-2026-20253
• Splunk vendor advisory SVD-2026-0603
• watchTowr blog
• Source repository (watchtowrlabs)

Notes

Auto-ingested from https://github.com/watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253 on 2026-06-28. First Splunk CVE ever added to CISA KEV (June 18, 2026; federal deadline June 21). The included script is a detection artifact — the full lo_export → RCE chain is documented in the watchTowr blog post but not included here. Older Splunk 9.x builds do not ship the vulnerable PostgreSQL sidecar and are not affected.