CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function

union isfuzzy=true
(
    CommonSecurityLog
    | where DeviceVendor =~ "Splunk"
    | where RequestURL has_any ("/services/search/jobs", "/services/data/inputs", "/services/admin", "/services/authentication", "/en-US/splunkd/__raw/services")
    | where isempty(AdditionalExtensions) or AdditionalExtensions !has "authToken"
    | where RequestMethod in ("POST", "GET", "DELETE")
    | project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, DeviceVendor, DeviceProduct, EventOutcome
),
(
    W3CIISLog
    | where csUriStem has_any ("/services/search/jobs", "/services/data/inputs", "/services/admin", "/services/authentication")
    | where isempty(csUsername) or csUsername == "-"
    | where csMethod in ("POST", "GET", "DELETE")
    | project TimeGenerated, cIP, csUriStem, csMethod, scStatus, csUsername
)
| where TimeGenerated > ago(24h)

index=proxy OR index=web OR index=splunk_audit
(uri_path="/services/search/jobs" OR uri_path="/services/data/inputs" OR uri_path="/services/admin*" OR uri_path="/services/authentication*" OR uri_path="/en-US/splunkd/__raw/services*")
NOT (auth_token=* OR http_user_agent="Splunk*" AND cookie=*)
| eval unauthenticated=if(isnull(username) OR username="-" OR username="", "true", "false")
| where unauthenticated="true"
| eval request_method=upper(method)
| where request_method IN ("POST", "GET", "DELETE", "PUT")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(src_ip) as source_ips by dest_ip, dest_port
| where count > 1
| eval first_seen=strftime(first_seen, "%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen, "%Y-%m-%dT%H:%M:%SZ")
| sort -count

sequence by source.ip with maxspan=5m
  [network where network.application == "http" and
   url.path : ("/services/search/jobs", "/services/data/inputs*", "/services/admin*", "/services/authentication*", "/en-US/splunkd/__raw/services*") and
   not (http.request.headers.authorization : "*" or http.request.headers.cookie : "*splunkd_*") and
   http.request.method in ("POST", "GET", "DELETE", "PUT")]
  [network where network.application == "http" and
   url.path : ("/services/search/jobs*", "/services/data*") and
   http.response.status_code in (200, 201, 400, 500)]

SELECT
    sourceip,
    destinationip,
    destinationport,
    URL,
    username,
    eventcount,
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time,
    category,
    logsourcename(logsourceid) as log_source
FROM events
WHERE
    destinationport IN (8000, 8089, 9997, 8088)
    AND (
        URL ILIKE '%/services/search/jobs%'
        OR URL ILIKE '%/services/data/inputs%'
        OR URL ILIKE '%/services/admin%'
        OR URL ILIKE '%/services/authentication%'
        OR URL ILIKE '%/en-US/splunkd/__raw/services%'
    )
    AND (username IS NULL OR username = '' OR username = '-')
    AND LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'IBM Security Network IPS (GX)', 'Palo Alto Networks Firewall', 'Check Point FireWall-1')
    AND LAST 24 HOURS
GROUP BY sourceip, destinationip, URL
HAVING eventcount > 2
ORDER BY eventcount DESC

_sourceCategory=*proxy* OR _sourceCategory=*web* OR _sourceCategory=*splunk*
| parse "* * * *" as src_ip, method, uri, status
| where uri matches "/services/search/jobs*" or uri matches "/services/data/inputs*" or uri matches "/services/admin*" or uri matches "/services/authentication*" or uri matches "/en-US/splunkd/__raw/services*"
| where !(uri matches "*splunkd_*") and !(uri matches "*auth_token*")
| where method in ("POST", "GET", "DELETE", "PUT")
| count by src_ip, uri, method, status
| where _count > 1
| sort by _count desc
| fields src_ip, uri, method, status, _count

rule cve_2026_20253_splunk_unauth_access {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects unauthenticated access to Splunk Enterprise critical API endpoints (CVE-2026-20253)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://advisory.splunk.com/advisories/SVD-2026-0603"

  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    $req.target.port in (8000, 8089, 9997)
    (
      re.regex($req.network.http.url, `/services/search/jobs`) or
      re.regex($req.network.http.url, `/services/data/inputs`) or
      re.regex($req.network.http.url, `/services/admin`) or
      re.regex($req.network.http.url, `/services/authentication`) or
      re.regex($req.network.http.url, `/en-US/splunkd/__raw/services`)
    )
    not re.regex($req.network.http.request_headers, `[Aa]uthorization: (Bearer|Splunk) `)
    not re.regex($req.network.http.request_headers, `Cookie: .*splunkd_`)
    $req.network.http.method in ("POST", "GET", "DELETE", "PUT")

  condition:
    $req
}

#event_simpleName=NetworkConnectIP4
| DestinationPort in (8000, 8089, 9997, 8088)
| HttpUrl = "/services/search/jobs*" OR HttpUrl = "/services/data/inputs*" OR HttpUrl = "/services/admin*" OR HttpUrl = "/services/authentication*" OR HttpUrl = "/en-US/splunkd/__raw/services*"
| NOT (HttpRequestHeaders = "*Authorization: Splunk*" OR HttpRequestHeaders = "*Authorization: Bearer*" OR HttpCookieHeader = "*splunkd_*")
| HttpMethod in ("POST", "GET", "DELETE", "PUT")
| stats count() as request_count, values(HttpUrl) as accessed_paths, values(HttpMethod) as methods by RemoteAddressIP4, LocalAddressIP4, DestinationPort
| where request_count > 1
| sort -request_count