Splunk Enterprise on AWS vulnerable to pre‑auth remote code execution by default
Splunk Enterprise versions 10+ on AWS ship with an enabled PostgreSQL Sidecar Service that lets unauthenticated attackers execute code remotely (CVE‑2026‑20253, CVSS 9.8). The flaw bypasses the web proxy and hits the sidecar endpoint directly, meaning default cloud deployments are exploitable out of the box. Patch or disable the sidecar to stop pre‑auth RCE.