Splunk Enterprise PostgreSQL Sidecar Pre-Auth RCE (CVE-2026-20253) | MSSP Advisory

Risk Assessment

CVE-2026-20253 is a pre-authentication remote code execution vulnerability in Splunk Enterprise affecting the PostgreSQL Sidecar Service endpoint, which ships enabled by default on Splunk Enterprise deployed on AWS. An unauthenticated attacker can reach the internal PostgreSQL API through the main Splunk web interface on port 8000, abuse the backup and restore endpoints to achieve arbitrary file write as the splunk user, and then overwrite a Python script that Splunk executes regularly to gain full RCE. The CVSS score is 9.8 and a public detection artifact generator has already been released by watchTowr.

If you or any of your clients run Splunk Enterprise on AWS, that instance is exploitable right now by anyone who can reach port 8000, no credentials required. Splunk is frequently the SIEM sitting at the center of a client security program, meaning an attacker who owns it owns the log pipeline, the alert logic, and potentially the credentials stored inside it. If a client gets hit through this and you had not told them about a 9.8 pre-auth RCE on their SIEM, that conversation with them will be very short and very final.