EUVD-2026-36088
GHSA-xgm5-jh99-wc4v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.
AnalysisAI
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.4.2604.3 and 10.2.2510.14) allows remote attackers to create or truncate files on the host via an unauthenticated PostgreSQL sidecar service endpoint. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) reflects trivial network exploitation, and no public exploit identified at time of analysis, though the missing-auth root cause and Splunk's high-value position in enterprise SOCs makes prompt patching warranted.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the PostgreSQL sidecar service endpoint shipped with Splunk Enterprise and Splunk Cloud Platform - no credentials, no user interaction, and no non-default configuration are needed per the description, since the missing authentication is in the sidecar itself rather than gated behind an optional feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point in the same direction: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8 because exploitation is network-reachable, low-complexity, requires no privileges or user interaction, and yields full CIA impact - consistent with a missing-auth file-write primitive that can be chained into RCE on a Splunk indexer or search head. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reach to a Splunk indexer or search head - either from the internet (if exposed) or after gaining an initial foothold on the internal network - sends a crafted unauthenticated request to the PostgreSQL sidecar endpoint and instructs it to truncate or create a file at an attacker-chosen path. By targeting files such as Splunk configuration, authentication state, or a writable script path used by a scheduled task, the attacker escalates the file-write primitive into denial of service, configuration tampering, or code execution under the Splunk service account. … |
| Remediation | Vendor-released patch: upgrade Splunk Enterprise to 10.2.4 or 10.0.7 (or later) on the appropriate maintenance branch, and confirm Splunk Cloud Platform tenants are on 10.4.2604.3 or 10.2.2510.14 (or later) - refer to https://advisory.splunk.com/advisories/SVD-2026-0603 for the official fixed-version matrix and any branch-specific guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Splunk Enterprise and Cloud Platform deployments and verify current versions against affected ranges (10.2.4 / 10.0.7 for Enterprise; 10.4.2604.3 / 10.2.2510.14 for Cloud). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Remote code execution in Splunk Enterprise, Splunk Cloud Platform, and the Splunk Secure Gateway app allows a low-privil
Stored cross-site scripting in Splunk Enterprise (below 10.2.4, 10.0.7, 9.4.12, 9.3.13) and Splunk Cloud Platform (below
CSS injection in Splunk Enterprise and Splunk Cloud Platform classic dashboards enables credential and sensitive data ex
Classic dashboard URL validation bypass in Splunk Enterprise and Splunk Cloud Platform enables low-privileged authentica
Classic dashboard drill-down links in Splunk Enterprise and Splunk Cloud Platform can be weaponized by low-privileged au
Share
External POC / Exploit Code
Leaving vuln.today