A lack of authentication on the PostgreSQL sidecar service endpoint allows a remote, unauthenticated user to create or truncate any file on the system. This flaw makes it possible for an attacker to write malicious files, overwrite existing binaries, or delete key files without permission. Because no credentials are required, the vulnerability can be exploited by any user who can reach the service over the network, potentially leading to data loss or unauthorized code execution.

Splunk Cloud Platform versions older than 10.4.2604.3 and 10.2.2510.14, and Splunk Enterprise versions older than 10.2.4 and 10.0.7 are affected. Users running these older builds are at risk until they upgrade to the specified safe releases.

The CVSS score of 9.8 reflects the high impact and ease of exploitation. No EPSS data is available, but the absence of authentication controls means the attacker does not need any additional credentials or privileges. The vulnerability has not been listed in the CISA KEV catalog, but the severity and lack of authentication make it a critical concern. Attackers with network reach to the sidecar endpoint can immediately exploit this issue to alter or delete files on the host.