LoFP LoFP / authorized red-team or penetration testing tooling exercising the cve-2026-20253 exploit chain. legitimate splunk user activity should not produce postgresql connection-string keywords, suspicious filesystem targets, empty basic auth credentials, or unauthenticated 400 responses on the recovery endpoints.

Techniques

Sample rules

Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts

Description

Detects CVE-2026-20253 exploit artifacts against the Splunk Enterprise PostgreSQL sidecar recovery endpoints via complementary signals. Where endpoint or Network Packet Capture request-body logging is available, the rule matches PostgreSQL connection-string injection keywords, suspicious backupFile destinations, and known filesystem artifacts used to pivot from backup/restore primitives to file write or RCE. It also detects vulnerable recovery endpoint probing and empty-password Basic auth credentials observed in public exploit tooling.

Detection logic

http.request.method:POST and
url.path:("*splunkd/__raw/v1/postgres/recovery/*" or "/v1/postgres/recovery/*") and
(
  http.request.body.content:(
    "*\"backupFile\"*../*" or
    "*\"backupFile\"*/dev/shm/*" or
    "*\"backupFile\"*/etc/cron*" or
    "*\"backupFile\"*/home/*/.ssh/*" or
    "*\"backupFile\"*/opt/splunk/bin/scripts/*" or
    "*\"backupFile\"*/opt/splunk/etc/apps/*" or
    "*\"backupFile\"*/root/*" or
    "*\"backupFile\"*/tmp/*" or
    "*\"backupFile\"*/var/tmp/*" or
    "*\"backupFile\"*authorized_keys*" or
    "*\"database\"*dbname=*" or
    "*\"database\"*host=*" or
    "*\"database\"*hostaddr=*" or
    "*\"database\"*passfile=*" or
    "*\"database\"*password=*" or
    "*\"database\"*port=*" or
    "*\"database\"*service=*" or
    "*\"database\"*sslmode=*" or
    "*\"database\"*user=*" or
    "*/opt/splunk/etc/apps/*" or
    "*/opt/splunk/var/packages/data/postgres/.pgpass*"
  ) or
  data_stream.dataset:zeek.http and url.password:"" or
  data_stream.dataset:(azure.application_gateway or gcp.loadbalancing_logs or network_traffic.http or suricata.eve or zeek.http) and
  url.path:(
    "*splunkd/__raw/v1/postgres/recovery/backup" or
    "*splunkd/__raw/v1/postgres/recovery/restore" or
    /v1/postgres/recovery/backup or
    /v1/postgres/recovery/restore
  ) and
  http.response.status_code:400
)