CVE-2026-20253 Splunk Enterprise Missing Authentication for Critical Function
Unauthenticated attackers can create or truncate arbitrary files via an unprotected PostgreSQL sidecar endpoint in Splunk Enterprise.
- Exploited in the wild
- Since 18 Jun 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-20253?
CVE-2026-20253 is a critical missing authorization vulnerability in Splunk Splunk, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
Weakness: CWE-306
Which versions are affected by CVE-2026-20253?
It affects 1 product.
Products include Splunk Splunk.
How do I fix CVE-2026-20253?
No fix has been published for CVE-2026-20253 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 21 Jun 2026.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-20253 being exploited?
Yes. Attackers have exploited CVE-2026-20253 in the wild since at least 18 Jun 2026.
Public exploit code: 1 Nuclei template and 7 proofs of concept on GitHub.
Other vulnerabilities in Splunk Splunk
- CVE-2026-76268 Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
- CVE-2026-76284 Improper Neutralization in Splunk Enterprise
- CVE-2026-76285 Improper Adherence to Coding Standards in Splunk Enterprise
- CVE-2017-17067 Auth bypass in n/a
- CVE-2016-10126 Information disclosure in n/a
Sources
Also known as GHSA-xgm5-jh99-wc4v.