Skip to content

Back to the catalog

watchTowr detection artifact generator for Splunk CVE-2026-20253
github.comrepo

watchTowr detection artifact generator for Splunk CVE-2026-20253

A Python script from watchTowr Labs that checks whether a Splunk Enterprise instance is vulnerable to CVE-2026-20253, a pre-auth RCE stemming from unauthenticated access to the PostgreSQL Sidecar Service's /v1/postgres/recovery/backup endpoint. It probes the endpoint and reports vulnerable/not-vulnerable based on the HTTP response code, without performing actual exploitation. Affected versions span Splunk Enterprise 10.0.0–10.0.6 and 10.2.0–10.2.3; 10.0.7, 10.2.4, and 10.4.0 are patched.

TL;DR Pre-auth RCE detection script for Splunk CVE-2026-20253, checking unauthenticated access to the PostgreSQL Sidecar Service backup endpoint.
Open original ↗
Document

What it is

A Python detection tool from watchTowr Labs (watchTowr-vs-Splunk-RCE-CVE-2026-20253.py, by Piotr / @chudyPB) that checks whether a Splunk Enterprise instance is vulnerable to CVE-2026-20253, a pre-auth RCE in the Splunk PostgreSQL Sidecar Service. Despite the "detection artifact generator" framing in the catalog summary, the page describes a remote vulnerability checker — it probes a live endpoint and reports vulnerable/not-vulnerable. It performs no exploitation.

How it works

It sends a request to the /v1/postgres/recovery/backup endpoint of the PostgreSQL Sidecar Service and interprets the HTTP status:

  • 400 — endpoint reachable, host is probably vulnerable
  • 401 — access blocked, probably not vulnerable
  • anything else — Sidecar Service likely not installed (not vulnerable), or the response was interfered with; verify manually

Run against a target:

python3 watchTowr-vs-Splunk-RCE-CVE-2026-20253.py -H http://vulnerable.splunk.lab:8000 -r en-US

-H is the target host; -r is the region string appearing in Splunk URLs (e.g. en-US). A vulnerable host prints [+] VULNERABLE - access to /v1/postgres/recovery/backup not blocked; a patched one prints [-] NOT VULNERABLE.

Preconditions / Affected

Per the vendor advisory as quoted on the page:

  • Vulnerable: Splunk Enterprise 10.2.0–10.2.3, and 10.0.0–10.0.6
  • Not vulnerable: 10.4.0, 10.2.4, 10.0.7

The tool was tested on 10.2.3 (vulnerable) and 10.2.4 (not vulnerable), both on Linux. The check depends on the PostgreSQL Sidecar Service being installed and its recovery endpoint being reachable.

What to do

If your build falls in 10.2.0–10.2.3 or 10.0.0–10.0.6, treat it as exposed and move to the nearest fixed release (10.0.7, 10.2.4, or 10.4.0). Note the version boundary is tight: 10.2.3 is vulnerable, 10.2.4 is not. Use the endpoint-response mapping above as a lightweight external verification, but a 400 is only a probable indicator.

Caveats

The page states the vulnerable/not-vulnerable verdicts are probabilistic ("probably"), and any non-400/401 response requires manual verification. Splunk 9 and other older builds were not tested. The check confirms endpoint accessibility, not that full pre-auth RCE succeeds.

CVEs named here

Technologies named here

Techniques named here

  • Unauthenticated endpoint access check
  • Pre-Auth RCE

Related in AppSec