CVE-2026-20253: Unauthenticated arbitrary file operations in Splunk Enterprise PostgreSQL sidecar service (SVD-2026-0603)

CVE-2026-20253 (CVSS 9.8 Critical) - Unauthenticated arbitrary file creation/truncation and RCE in Splunk Enterprise PostgreSQL sidecar service. The sidecar exposes /v1/postgres/recovery/backup and /v1/postgres/recovery/restore endpoints through Splunk's web app (port 8000) with NO authentication (CWE-306). The backup endpoint calls pg_dump with attacker-controlled -U (username from Authorization header), -f (backupFile from JSON body), and database (positional dbname from JSON body, interpreted as libpq connection string). The restore endpoint calls pg_restore similarly. An attacker chains: (1) redirect pg_dump to attacker-controlled PostgreSQL via connection string injection in database param, (2) restore malicious dump into local Postgres using .pgpass file at /opt/splunk/var/packages/data/postgres/.pgpass (postgres_admin credentials), (3) SQL in dump uses lo_from_bytea+lo_export to write arbitrary files, (4) overwrite a Python script Splunk executes on schedule for RCE. CISA KEV added 2026-06-18, action due 2026-06-21.