CVE-2026-20253

The Splunk web application can proxy requests to the local PostgreSQL API, which does not check credentials. By sending a request to the backup endpoint of that API, an attacker can write empty files anywhere in the file system and with any name by creating a backup without authenticating to a specific database. By using a pg_dump parameter, it is possible to “backup” an external database over the network, for example hosted by the attacker. The same API also contains a restore endpoint that not only allows an attacker to restore the database they dumped, but also to restore a .pgpass file, allowing an attacker to authenticate. This means an attacker can restore attacker-controlled SQL and interact with the local database, which leads to arbitrary file writes, which allows them to execute arbitrary commands.

EPSS 1.73% · 74.7th percentile