TLDR Tech / InfoSec
Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)
CVE-2026-20253 (CVSS 9.8) allows unauthenticated attackers to access Splunk Enterprise's PostgreSQL Sidecar Service via the main web application proxy at /en-US/splunkd/__raw/v1/postgres/recovery/. This vulnerability converts the loopback-bound service on port 5435 into an attack surface accessible over the network without credentials. The exploit involves injecting a connection string into the database parameter to redirect pg_dump to an attacker-controlled host, resulting in a malicious database dump containing a lo_export function that can write arbitrary files during restore. The attacker then locates a plaintext .pgpass file at /opt/splunk/var/packages/data/postgres/.pgpass to authenticate with the local PostgreSQL instance and overwrites the ssg_enable_modular_input.py script, achieving remote code execution as the splunk user. Out-of-the-box, Splunk Enterprise versions 10.0.0-10.0.6 and 10.2.0-10.2.3 on AWS are vulnerable. To mitigate, update to 10.0.7 or 10.2.4 respectively, restrict external access to the /__raw/ proxy path, and handle .pgpass files in Splunk deployments as secret as sensitive as private keys.
Read the full story