## https://sploitus.com/exploit?id=F0C31C9B-0A65-5448-9175-384AF0B76ABF
# CVE-2026-20253 Splunk Pre-Auth RCE
Splunk Pre-Auth RCE 1day Detection Artifact Generator Tool
# Detection in Action
Detection Artifact Generator attempts to access the `/v1/postgres/recovery/backup` endpoint of PostgreSQL Sidecar Service to verify if it is accessible or not:
* 400 response - probably vulnerable
* 401 response - probably not vulnerable
* any other - PostgreSQL Sidecar Service not installed (not vulnerable) or something affected the response, please verify manually
Script was tested on:
* Splunk Enterprise 10.2.3 on Linux (vulnerable)
* Splunk Enterprise 10.2.4 on Linux (not vulnerable)
Some older builds (like Splunk 9) were not tested.
This vulnerability leads to the Pre-Auth RCE when fully exploited. No exploitation attempts are performed by this script.
You need to provide following inputs:
* `-H` - target host.
* `-r` - region of your Splunk installation (appears in the URLs), like: `en-US`.
Sample run against vulnerable instance:
```
$ python3 watchTowr-vs-Splunk-RCE-CVE-2026-20253.py -H http://vulnerable.splunk.lab:8000 -r en-US
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchTowr-vs-Splunk-CVE-2026-20253.py
(*) CVE-2026-20253 Splunk PostgreSQL Sidecar Service Detection Artifact Generator
- Piotr (@chudyPB) of watchTowr (@watchTowrcyber)
[+] VULNERABLE - access to /v1/postgres/recovery/backup not blocked
```
Sample run against patched instance:
```
$ python3 watchTowr-vs-Splunk-RCE-CVE-2026-20253.py -H http://not.vulnerable.splunk.lab:8000 -r en-US
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchTowr-vs-Splunk-CVE-2026-20253.py
(*) CVE-2026-20253 Splunk PostgreSQL Sidecar Service Detection Artifact Generator
- Piotr (@chudyPB) of watchTowr (@watchTowrcyber)
[-] NOT VULNERABLE - access to /v1/postgres/recovery/backup blocked
```
# Description
This script attempts to detect if Splunk is vulnerable to CVE-2026-20253 Pre-Auth RCE.
# Affected Versions
According to [vendor advisory](https://advisory.splunk.com/advisories/SVD-2026-0603):
* Splunk Enterprise 10.4.0 - NOT VULNERABLE
* Splunk Enterprise 10.2.4 - NOT VULNERABLE
* Splunk Enterprise 10.0.7 - NOT VULNERABLE
* Splunk Enterprise 10.2.0 to 10.2.3 - VULNERABLE
* Splunk Enterprise 10.0.0 to 10.0.6 - VULNERABLE
# Follow [watchTowr](https://watchTowr.com) Labs
For the latest security research follow the [watchTowr](https://watchTowr.com) Labs Team
- https://labs.watchtowr.com/
- https://x.com/watchtowrcyber