{"id":11962,"date":"2026-09-21T12:35:28","date_gmt":"2026-09-21T18:35:28","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-105-pre-authenticated-rce-vulnerability-in-splunk-enterprise\/"},"modified":"2026-09-29T10:59:08","modified_gmt":"2026-09-29T16:59:08","slug":"alert-2026-105-pre-authenticated-rce-vulnerability-in-splunk-enterprise","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-105-pre-authenticated-rce-vulnerability-in-splunk-enterprise\/","title":{"rendered":"Alert 2026-105 Pre-authenticated RCE Vulnerability in Splunk Enterprise"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fixed version<\/strong><\/td><\/tr>
Splunk Enterprise<\/strong><\/td>10.0.0 to 10.0.6<\/td>10.0.7 or later<\/td><\/tr>
Splunk Enterprise<\/strong><\/td>10.2.0 to 10.2.3<\/td>10.2.4 or later<\/td><\/tr>
Splunk Enterprise<\/strong><\/td>10.4<\/td>Not affected<\/td><\/tr>
Splunk Cloud Platform<\/strong><\/td>Not affected<\/td>Not applicable<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

*The vulnerability only affects Splunk Enterprise using the PostgreSQL sidecar<\/em> component. Splunk Cloud Platform is not affected<\/strong>, since it does not use Postgres sidecars<\/em>.<\/p>\n\n

Description<\/h2>\n\n

A vulnerability labeled CVE\u20112026\u201120253<\/strong> was identified, a critical vulnerability in Splunk Enterprise<\/strong> with a CVSS 9.8<\/strong> score. The flaw allows a remote unauthenticated attacker to perform arbitrary file operations through an exposed endpoint of the PostgreSQL sidecar<\/em> service and, through an attack chain, achieve remote code execution (RCE)<\/strong> on the Splunk server.<\/p>\n\n

CVE\u20112026\u201120253<\/strong> occurs because the PostgreSQL sidecar<\/em> service endpoint lacks authentication controls. Any actor able to reach the service over the network can invoke file operations without providing credentials.thehackernews<\/a><\/p>\n\n

The vulnerability allows creating or truncating arbitrary files and can be chained to achieve pre-authentication RCE. The endpoints involved in the disclosed technical chain are:<\/p>\n\n

\/v1\/postgres\/recovery\/backup
\/v1\/postgres\/recovery\/restore<\/p>\n\n

The research team demonstrated that an attacker can use the \/backup endpoint to connect to a PostgreSQL database under their control and save a dump<\/em> to an arbitrary path on the Splunk server’s file system. Subsequently, they can invoke \/restore, leveraging a local .pgpass file containing the postgres_admin account password, to restore attacker-controlled content into the local PostgreSQL instance.<\/p>\n\n

Although initially there were no reports of exploitation, the Splunk Product Security Incident Response Team (PSIRT<\/strong>) reported on June 18, 2026 that it had knowledge of limited exploitation<\/strong> of the vulnerability. CISA added CVE\u20112026\u201120253 to its Known Exploited Vulnerabilities (KEV<\/strong>) catalog, so immediate updating is recommended, along with reviewing potential indicators of compromise.<\/p>\n\n

Solution<\/h2>\n\n