CVE-2026-20253-Splunk-Enterprise-Pre-Auth-RCE-

Proof-of-concept exploit for CVE-2026-20253, enabling unauthenticated remote code execution on vulnerable Splunk Enterprise instances via file write primitive and PostgreSQL-based payload delivery.

This repository contains a functional Proof of Concept (PoC) for the vulnerability CVE-2026-20253, which affects Splunk Enterprise in specific versions. The vulnerability allows an unauthenticated attacker to:

• Create arbitrary files on the system
• Truncate existing files
• Execute commands remotely (RCE) as the splunk user

Technical research was conducted by watchTowr Labs and the vulnerability was reported by Alex Hordijk (hordalex).

🔍 Vulnerability Details

Affected Versions

Impact

• Authentication: Not required
• Attack Complexity: Low
• Impact: Confidentiality, Integrity, and Availability (COMPLETE)

🚀 PoC Features

✅ Vulnerability Detection - Checks if the target is vulnerable ✅ File Write Primitive - Creates/truncates arbitrary files ✅ Remote Code Execution - Executes commands on the target system ✅ Readable Results - Retrieves the output of executed commands ✅ Cleanup - Option to remove created artifacts

📦 Requirements

• Python 3.6+
• requests (Python library)
• Splunk Enterprise vulnerable (for testing)

Dependency Installation

🔬 How It Works

Attack Chain

1. Detection: The script checks if the /backup endpoint is accessible without authentication.
2. File Write Primitive: Using the /backup endpoint, the script creates empty files in any location on the system.
3. RCE (Remote Code Execution):
   • The script connects to a PostgreSQL server controlled by the attacker
   • Uses pg_dump to create a malicious dump on the target system
   • Uses pg_restore to execute PL/pgSQL functions that write the payload
   • The payload is written into a script that Splunk executes automatically
4. Command Execution: The malicious script runs and the result is saved in a file accessible via the web.

Attack Diagram