watchtowrlabs/watchtowr-vs-splunk-cve-2026-20253
Splunk Pre-Auth RCE 1day Detection Artifact Generator Tool
Detection Artifact Generator attempts to access the /v1/postgres/recovery/backup endpoint of PostgreSQL Sidecar Service to verify if it is accessible or not:
Script was tested on:
Some older builds (like Splunk 9) were not tested.
This vulnerability leads to the Pre-Auth RCE when fully exploited. No exploitation attempts are performed by this script.
You need to provide following inputs:
-H - target host.-r - region of your Splunk installation (appears in the URLs), like: en-US.Sample run against vulnerable instance:
$ python3 watchTowr-vs-Splunk-RCE-CVE-2026-20253.py -H http://vulnerable.splunk.lab:8000 -r en-US
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchTowr-vs-Splunk-CVE-2026-20253.py
(*) CVE-2026-20253 Splunk PostgreSQL Sidecar Service Detection Artifact Generator
- Piotr (@chudyPB) of watchTowr (@watchTowrcyber)
[+] VULNERABLE - access to /v1/postgres/recovery/backup not blocked
Sample run against patched instance:
$ python3 watchTowr-vs-Splunk-RCE-CVE-2026-20253.py -H http://not.vulnerable.splunk.lab:8000 -r en-US
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchTowr-vs-Splunk-CVE-2026-20253.py
(*) CVE-2026-20253 Splunk PostgreSQL Sidecar Service Detection Artifact Generator
- Piotr (@chudyPB) of watchTowr (@watchTowrcyber)
[-] NOT VULNERABLE - access to /v1/postgres/recovery/backup blocked
This script attempts to detect if Splunk is vulnerable to CVE-2026-20253 Pre-Auth RCE.
According to vendor advisory:
For the latest security research follow the watchTowr Labs Team