Splunk Enterprise RCE (CVE-2026-20253)

This report documents CVE-2026-20253, a critical unauthenticated vulnerability in Splunk Enterprise's PostgreSQL sidecar recovery endpoints that allows attackers—via the Splunk Web reverse-proxy—to perform path traversal and arbitrary file writes, inject connection strings to dump attacker-controlled data, reuse the Splunk .pgpass file to obtain privileged credentials, and overwrite scheduled Python scripts to achieve remote code execution; exploitation can lead to telemetry tampering, credential theft, persistence, and lateral movement.