Missing Authentication in Splunk Enterprise (CVE-2026-20253) — Unauthenticated Arbitrary File Create/Truncate, Targeting the Monitoring Platform Itself

Missing authentication for a critical function (CWE-306) describes a state in which a powerful capability that should only be usable after a login or a permission check can instead be invoked by anyone, with no check at all.

Here that capability is a PostgreSQL (database) sidecar service endpoint bundled with Splunk Enterprise: because no authentication mechanism is implemented, anyone able to reach it over the network can invoke file operations without credentials. According to the vendor, the available operations are creating and truncating (emptying out) arbitrary files.

What makes this severe is that the target is the monitoring platform itself. In many organizations Splunk serves as the watchtower — collecting logs from every system to detect the signs of an attack. An unauthenticated door into that watchtower means the defender's own vantage point becomes the object of attack.

Nor should it be overlooked that file creation enables planting malicious files, while truncation enables erasing logs — that is, destroying evidence. If monitoring logs are quietly emptied, the traces of other attacks can be wiped along with them.

The basic response is to update to a fixed release (10.2.4 or later / 10.0.7 or later) per Splunk's guidance. As a mitigation when you cannot update immediately, the vendor points to disabling the affected PostgreSQL sidecar service.

CISA added this under BOD 26-04 — the risk-based directive that supersedes the older fixed-deadline BOD 22-01 — and set a remediation window of just three days after the addition, a sign of how pressing the exploitation risk was judged to be.