CVE-2026-20253 is a critical vulnerability affecting Splunk Enterprise versions 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3. The flaw exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to perform file operations such as creating or truncating arbitrary files without credentials. This vulnerability is actively exploited in the wild, as confirmed by CISA, which has issued a binding directive requiring U.S. federal agencies to patch affected systems by a specified deadline. Splunk released patches shortly after disclosure and updated advisories urging immediate patching. For systems that cannot be patched immediately, disabling the PostgreSQL sidecar service is advised, though this may break certain functionalities like Edge Processor, OpAmp, or SPL2 data pipelines. The vulnerability poses significant risks due to its ease of exploitation and potential for remote code execution as demonstrated by proof-of-concept exploits.

The vulnerability allows unauthenticated remote attackers to create or truncate arbitrary files on vulnerable Splunk Enterprise systems, potentially leading to remote code execution. This can compromise the confidentiality, integrity, and availability of affected systems. The active exploitation in the wild increases the urgency and risk, especially for internet-exposed Splunk instances. Disruption of critical Splunk data pipelines may occur if mitigation by disabling the PostgreSQL sidecar service is applied.

Splunk has released official patches that remediate this vulnerability; customers are strongly urged to upgrade to the fixed software releases immediately. For environments where immediate patching is not feasible, disabling the PostgreSQL sidecar service endpoint is recommended to remove the attack surface, with the caveat that this may disrupt Edge Processor, OpAmp, or SPL2 data pipelines. CISA mandates U.S. federal agencies to patch by the specified deadline. Patch status is confirmed as fixed in the updated Splunk releases; users should consult the official Splunk security advisory for exact fixed versions and apply updates promptly.