CVE-2026-20253: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

Synopsis

An unauthenticated arbitrary file creation and truncation vulnerability exists in Splunk Enterprise versions 10.0.x before 10.0.7 and 10.2.x before 10.2.4. The flaw is reachable over the network with no credentials required, because the PostgreSQL sidecar service endpoint exposes file operation capabilities without any authentication controls. Successful exploitation lets an attacker create or overwrite arbitrary files on the host, enabling data tampering, service disruption, and potential code execution via file manipulation. Patched-image rebuilds at versions 10.0.7 and 10.2.4 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable PostgreSQL sidecar service endpoint must be reachable over the network; any host that can send requests to the service is a viable attacker position.

• AuthenticationNot required

  No credentials of any kind are required; the endpoint exposes file operations to unauthenticated callers.

• Victim interactionNot required

  No user action is needed; the attacker sends requests directly to the service without involving any other party.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are needed to trigger the vulnerability.

Blast Radius

• An attacker can create new files at arbitrary paths on the host filesystem, including in sensitive directories.
• An attacker can truncate existing files, wiping configuration files, authentication databases, or application data.
• Truncating or replacing critical Splunk files crashes or destabilizes the Splunk Enterprise service.
• Overwriting executable or configuration files can be a stepping stone to remote code execution if the written content is subsequently loaded or executed by the service.