Splunk Enterprise's open sidecar: the unauthenticated 9.8 that turns your SIEM into a foothold (CVE-2026-20253)

Splunk is the thing that is supposed to see the attack. It ingests the logs, runs the detections, and sits at the center of the SOC with broad network reach and a wallet full of credentials. That position is exactly why an unauthenticated remote flaw in it is worse than the CVSS number suggests. CVE-2026-20253 is that flaw: a PostgreSQL sidecar service that Splunk Enterprise 10.x ships alongside its newer data-pipeline features answered the network with no application-level authentication, letting anyone who could reach it create and truncate files on the box.

What actually broke

Splunk classifies this as Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint (advisory SVD-2026-0603). The weakness is CWE-306: Missing Authentication for a Critical Function — the sidecar endpoint exposed file operations to the network but never required a valid application session to invoke them. An arbitrary file-write primitive on a box that runs services is a code-execution primitive: put a file where something executable, scheduled, or config-loaded reads it, and you are running as the Splunk service account. Splunk's PSIRT (Cisco PSIRT, post-acquisition) confirmed limited exploitation in June 2026, and CISA added it to the Known Exploited Vulnerabilities catalog.

A new feature is a new attack surface

The PostgreSQL sidecar is not legacy plumbing — it arrived with Splunk's 10.x data-management stack and backs Edge Processor, OpAmp, and SPL2 data pipelines. That is why the version math is counter-intuitive: the old 9.x line never had the component and is untouched, the newest 10.4 already shipped with the fix, and it is the in-between 10.0 and 10.2 branches that are exposed. Newer was not automatically safer here; the danger window is precisely the releases that carried the feature before it was hardened.

The path from a stray request to a foothold

Why a Splunk 9.8 is worse than an average 9.8

A generic pre-auth RCE gives an attacker one box. A pre-auth RCE on the SIEM gives them the box and the eyes watching the rest of them. The integrity impact in the vector (I:H) is not abstract here: the same platform an attacker lands on is where your detections run, where log data is stored, and where forwarder and integration credentials often live. Compromise it and they can blunt the exact telemetry you'd use to notice them, then pivot outward with what Splunk already knows.

Fix it — patch, or disable the sidecar

There are two levers. Upgrading is the durable fix and costs you nothing in features. Disabling the sidecar removes the exposed endpoint immediately, but it is a stopgap with a real trade-off.

# server.conf — vendor stopgap ONLY if you do not use
# Edge Processor, OpAmp, or SPL2 data pipelines
[postgres]
disabled = true

splunk versionsplunk restart

1. Inventory splunkd versions and flag anything on 10.0.0–10.0.6 or 10.2.0–10.2.3.
2. Upgrade to 10.0.7 / 10.2.4 / 10.4.0+ — the fix that keeps your pipelines.
3. Cannot patch this hour and don't use Edge Processor / OpAmp / SPL2? Disable the sidecar in server.conf and restart.
4. Restrict network reachability of splunkd management and sidecar ports to trusted admin networks — this endpoint should never face the internet.
5. For any instance that was broadly reachable, hunt: look for unexpected or recently truncated files under the Splunk install and sidecar data directories, review recent restarts and config changes, and rotate the secrets and integration credentials Splunk holds.

The honesty section: KEV says yes, our PoC column says nothing

Keep the three signals separate, because they disagree in an instructive way. CVSS 9.8 is impact — how bad it is if exploited. EPSS 0.962 (99.87th percentile) is likelihood — the model thinks this gets hit. CISA KEV is confirmation — it is already being hit, and Splunk's own PSIRT observed limited exploitation. Against all of that, the cve.tools exploit index still shows zero public proof-of-concept and no Metasploit or Nuclei module. A public technical analysis has been published by a third party, but 'no PoC in the index' is not 'no exploit in the world.' The absence of a copy-paste exploit is a reason to patch faster, not slower.

Scores and exploitation status current as of 31 July 2026live record →