In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

Exploitation has been observed for this flaw in Splunk Enterprise following the publication of a proof-of-concept exploit. Apply the available patches as soon as possible.

A proof-of-concept has been published for this vulnerability in Splunk Enterprise. We are monitoring for exploitation. Apply the available patches as soon as possible.

The detected Splunk Enterprise instance exposes an unauthenticated PostgreSQL sidecar service endpoint reachable through the splunkd __raw proxy. The endpoint lacks authentication controls, allowing any network-reachable, unauthenticated user to invoke file operations, which can be leveraged to achieve remote code execution. The scanner confirmed the vulnerability by interacting with the unprotected backend endpoint.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2026-0603 advisory.

  - In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below     10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a     PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar     service endpoint lacks authentication controls, allowing any network-reachable user to invoke file     operations without credentials. (CVE-2026-20253)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
115266	Splunk Enterprise < 10.0.7 / 10.2.x < 10.2.4 Remote Code Execution	Web App Scanning	Component Vulnerability	critical
320366	Splunk Enterprise 10.0.0 < 10.0.7, 10.2.0 < 10.2.4 (SVD-2026-0603)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2026-20253

critical

Tenable Plugins

critical

critical