Missing Authentication in Splunk Enterprise (CVE-2026-20253) — Unauthenticated Arbitrary File Create/Truncate, Targeting the Monitoring Platform Itself

1Missing authentication for a critical function

Missing authentication for a critical function (CWE-306) describes a state in which a powerful capability that should only be usable after a login or a permission check can instead be invoked by anyone, with no check at all.

Here that capability is a PostgreSQL (database) sidecar service endpoint bundled with Splunk Enterprise: because no authentication mechanism is implemented, anyone able to reach it over the network can invoke file operations without credentials. According to the vendor, the available operations are creating and truncating (emptying out) arbitrary files.

2When the monitoring platform itself is the target

What makes this severe is that the target is the monitoring platform itself. In many organizations Splunk serves as the watchtower — collecting logs from every system to detect the signs of an attack. An unauthenticated door into that watchtower means the defender's own vantage point becomes the object of attack.

Nor should it be overlooked that file creation enables planting malicious files, while truncation enables erasing logs — that is, destroying evidence. If monitoring logs are quietly emptied, the traces of other attacks can be wiped along with them.

3Updating to the fixed release

The basic response is to update to a fixed release (10.2.4 or later / 10.0.7 or later) per Splunk's guidance. As a mitigation when you cannot update immediately, the vendor points to disabling the affected PostgreSQL sidecar service.

CISA added this under BOD 26-04 — the risk-based directive that supersedes the older fixed-deadline BOD 22-01 — and set a remediation window of just three days after the addition, a sign of how pressing the exploitation risk was judged to be.

4The watchtower itself becomes the target

What makes this heavy is that the subject is the monitoring platform. When the defender's observation point becomes the target, what is lost is more than the monitoring function.

The vendor states the possible operations are creating and truncating arbitrary files — truncation meaning emptying a file's contents. Creation leads to planting a malicious file; truncation leads to erasing logs and destroying evidence. The basic response is updating to a fixed version, with the vendor offering disabling the PostgreSQL sidecar service as mitigation where updating cannot happen immediately.