Splunk Enterprise Critical Zero-Day Enables Pre-Auth RCE: When the SIEM Becomes the Entry Point

Splunk published advisory SVD-2026-0603 on June 10, 2026 for CVE-2026-20253, a pre-authentication vulnerability in the Splunk Enterprise PostgreSQL sidecar service. With a CVSS 9.8 rating, confirmed exploitation in the wild, and inclusion in the CISA KEV catalog, U.S. federal civilian agencies received a three-day patch deadline. The incident highlights an operational contradiction: the tool organizations use to detect attacks can become the attacker's entry point.

The Mechanism: From Unauthenticated Endpoint to RCE

The vulnerability resides in a PostgreSQL "sidecar" service introduced in Splunk Enterprise to support Edge Processor, OpAmp, and SPL2 pipeline functionality. According to technical analysis published by watchTowr Labs on June 12, 2026, the exposed REST endpoint requires no authentication. The exploit leverages injection in the hostaddr parameter, PostgreSQL's lo_export function for arbitrary file write, reading the .pgpass file, and overwriting the ssg_enable_modular_input.py Python module to achieve remote code execution.

The chain was demonstrated by Alex Hordijk (hordalex), who discovered the vulnerability, and published by Piotr Bazydlo and Yordan Ganchev of watchTowr Labs. The demo shows a four-step path from file write to pre-auth RCE. Splunk Cloud is explicitly excluded from impact, as the sidecar is not present in the managed cloud infrastructure.

"every database has auth" — watchTowr Labs (Piotr Bazydlo and Yordan Ganchev), cited by tech-insider.org, referring to the anomaly of a PostgreSQL service exposed without authentication.

Timeline: Eight Days from Disclosure to Federal Agency Scramble

Splunk released advisory SVD-2026-0603 on June 10, 2026. On June 12, watchTowr Labs published the full technical analysis with proof-of-concept. Two days later, on June 18, Splunk PSIRT confirmed "limited exploitation of this vulnerability," according to a quote reported by The Hacker News. The same day, CISA added CVE-2026-20253 to the KEV catalog with a deadline for federal civilian agencies set for June 21, 2026 — a three-day window under Binding Operational Directive 26-04.

The confirmation of exploitation in the wild and the CISA deadline are reported by both tech-insider.org and The Hacker News. The specific presence of CVE-2026-20253 in the CISA KEV catalog was not directly verified in the provided cisa.gov source text, but is corroborated by the two converging editorial sources.

Affected Versions, Fixes, and Workaround with Functional Degradation

According to tech-insider.org and The Hacker News, vulnerable versions are Splunk Enterprise 10.2.0, 10.2.1, 10.2.2, 10.2.3 and 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6. The 10.4.x branch is not affected. Versions 9.4.x and earlier are excluded because the PostgreSQL sidecar is not present.

The releases that fix the vulnerability are 10.2.4 and later in the 10.2 branch, and 10.0.7 and later in the 10.0 branch. On AWS the sidecar is enabled by default, which exposes out-of-the-box installations unless reconfigured. The only documented workaround is to disable the sidecar with the directive [postgres] disabled = true in server.conf, resulting in loss of Edge Processor, OpAmp, and SPL2 pipeline functionality.

Immediate Actions

For administrators managing Splunk Enterprise on-premise or on AWS, four priority actions apply. Update to versions 10.2.4+ or 10.0.7+ where available. Verify the presence of the PostgreSQL sidecar service in 10.0.x and 10.2.x installations. If the patch cannot be applied immediately, disable the sidecar with the documented parameter, accepting the functional degradation. Monitor logs for access to the /v1/postgres/recovery/backup and /v1/postgres/recovery/restore endpoints preceding fix availability.

The Cisco Context and Post-Acquisition Security Pressure

Cisco's acquisition of Splunk for approximately $28 billion, completed prior to this event according to SecurityWeek, places the vulnerability in a strategic light. Cisco has integrated Splunk as its central security analytics platform; a pre-auth zero-day in the flagship product of the acquisition represents a stress test for the security assurances offered to enterprise and government customers. The number of internet-exposed instances is not quantified in the dossier, nor have victim organizations or the scope of the "limited exploitation" confirmed by Splunk been publicly disclosed.

The three-day deadline imposed by CISA is exceptionally tight even by KEV catalog standards. It signals an acceleration in federal response policies that reduces maneuvering room for infrastructure teams. For SOCs, the specific risk is operational blindness: if the SIEM is compromised, the attacker can manipulate detection data or disrupt visibility while moving laterally through the network.

Sources

• https://tech-insider.org/splunk-zero-day-cve-2026-20253/
• https://advisory.splunk.com/
• https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html
• https://advisory.splunk.com/advisories
• https://www.cve.org/CVERecord?id=CVE-2026-20298
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.securityweek.com/cisco-completes-28-billion-acquisition-of-splunk/

Information has been verified against cited sources and updated at time of publication.

Sources