Splunk Enterprise versions prior to 10.0.7 and 10.2.4 contain a critical vulnerability (CVE-2026-20253) in the PostgreSQL sidecar service endpoint, which lacks authentication controls. This allows unauthenticated attackers to create or truncate arbitrary files via the /v1/postgres/recovery/backup and /v1/postgres/recovery/restore endpoints. The attack involves dumping an attacker-controlled database to the Splunk file system and restoring it to execute malicious SQL commands, enabling arbitrary file writes. This can be escalated to remote code execution by overwriting Python scripts that Splunk executes. The vulnerability has a CVSS rating of 9.8. Splunk Cloud is not impacted as it does not use PostgreSQL sidecars. The issue is fixed in Splunk Enterprise 10.0.7 and 10.2.4.

An unauthenticated attacker can perform arbitrary file operations and achieve remote code execution on vulnerable Splunk Enterprise instances. This compromises the integrity and security of the affected system, potentially allowing attackers to pivot through a security monitoring tool that organizations rely on for threat detection. There is no evidence of exploitation in the wild yet, but exploit details are publicly available, increasing risk.

A patch is available. Users should upgrade Splunk Enterprise to version 10.0.7 or later, or 10.2.4 or later, to remediate this vulnerability. Splunk Cloud customers are not affected and require no action. Immediate application of the official fixes is recommended to prevent exploitation.