EUVD-2026-36088
GHSA-xgm5-jh99-wc4v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.
Articles & Coverage 4
AnalysisAI
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.4.2604.3 and 10.2.2510.14) allows remote attackers to create or truncate files on the host via an unauthenticated PostgreSQL sidecar service endpoint. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) reflects trivial network exploitation, and no public exploit identified at time of analysis, though the missing-auth root cause and Splunk's high-value position in enterprise SOCs makes prompt patching warranted.
Technical ContextAI
The flaw lives in a PostgreSQL sidecar service shipped with modern Splunk deployments - a co-located helper process that fronts the embedded PostgreSQL instance Splunk uses for parts of its platform state. The CWE-306 (Missing Authentication for Critical Function) classification confirms the root cause: the sidecar exposes a network endpoint that performs privileged file operations (create / truncate) but performs no credential check on the caller. The affected CPEs cover both the on-premises Splunk Enterprise product (cpe:2.3:a:splunk:splunk_enterprise) and the managed Splunk Cloud Platform (cpe:2.3:a:splunk:splunk_cloud_platform), indicating the vulnerable sidecar is part of the shared core platform rather than a deployment-specific add-on.
RemediationAI
Vendor-released patch: upgrade Splunk Enterprise to 10.2.4 or 10.0.7 (or later) on the appropriate maintenance branch, and confirm Splunk Cloud Platform tenants are on 10.4.2604.3 or 10.2.2510.14 (or later) - refer to https://advisory.splunk.com/advisories/SVD-2026-0603 for the official fixed-version matrix and any branch-specific guidance. Where immediate patching is not possible, restrict network reachability to the PostgreSQL sidecar service by binding it to loopback or the internal cluster interface only and adding host-firewall rules that deny inbound connections to the sidecar port from anything other than colocated Splunk components - the trade-off is that any monitoring, backup, or clustering tooling that legitimately reaches the sidecar across hosts will need its source IPs explicitly allowlisted. Verify post-upgrade that the sidecar endpoint now rejects unauthenticated requests before removing compensating network restrictions.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extens
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today