The vulnerability in Splunk Enterprise and Splunk Cloud Platform arises because the PostgreSQL sidecar service endpoint lacks authentication controls. This design flaw permits any network-reachable unauthenticated user to invoke file operations such as creating or truncating arbitrary files. Affected versions include Splunk Enterprise prior to 10.2.4 and 10.0.7, and Splunk Cloud Platform prior to 10.4.2604.3 and 10.2.2510.14. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can remotely create or truncate arbitrary files on the affected system via the PostgreSQL sidecar service endpoint. This can lead to full compromise of confidentiality, integrity, and availability of the system. The vulnerability enables unauthorized file manipulation without any credentials, potentially allowing disruption of service or data tampering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users should monitor Splunk's official advisories for updates. Until a fix is available, restrict network access to the PostgreSQL sidecar service endpoint to trusted users only to mitigate risk.