{"id":1646,"date":"2026-06-16T07:57:10","date_gmt":"2026-06-16T00:57:10","guid":{"rendered":"https:\/\/vncybers.vn\/lo-hong-splunk-enterprise-cve-2026-20253-vi-sao-dich-vu-sidecar-co-the-mo-uong-cho-rce-khong-can-ang-nhap\/"},"modified":"2026-06-20T08:11:24","modified_gmt":"2026-06-20T01:11:24","slug":"lo-hong-splunk-enterprise-cve-2026-20253-vi-sao-dich-vu-sidecar-co-the-mo-duong-cho-rce-khong-can-dang-nhap","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/lo-hong-splunk-enterprise-cve-2026-20253-vi-sao-dich-vu-sidecar-co-the-mo-duong-cho-rce-khong-can-dang-nhap\/","title":{"rendered":"L\u1ed7 h\u1ed5ng Splunk Enterprise CVE-2026-20253: V\u00ec sao d\u1ecbch v\u1ee5 sidecar c\u00f3 th\u1ec3 m\u1edf \u0111\u01b0\u1eddng cho RCE kh\u00f4ng c\u1ea7n \u0111\u0103ng nh\u1eadp"},"content":{"rendered":"

Splunk Enterprise CVE-2026-20253<\/strong> \u0111ang tr\u1edf th\u00e0nh m\u1ed9t v\u00ed d\u1ee5 \u0111\u00e1ng ch\u00fa \u00fd v\u1ec1 r\u1ee7i ro b\u1ea3o m\u1eadt trong c\u00e1c th\u00e0nh ph\u1ea7n ph\u1ee5 tr\u1ee3 c\u1ee7a n\u1ec1n t\u1ea3ng gi\u00e1m s\u00e1t d\u1eef li\u1ec7u. Theo advisory c\u1ee7a Splunk v\u00e0 ph\u00e2n t\u00edch k\u1ef9 thu\u1eadt \u0111\u01b0\u1ee3c The Hacker News t\u1ed5ng h\u1ee3p, l\u1ed7 h\u1ed5ng n\u1eb1m \u1edf m\u1ed9t endpoint c\u1ee7a d\u1ecbch v\u1ee5 PostgreSQL sidecar, n\u01a1i c\u01a1 ch\u1ebf x\u00e1c th\u1ef1c kh\u00f4ng \u0111\u01b0\u1ee3c \u00e1p d\u1ee5ng \u0111\u00fang c\u00e1ch.<\/p>\n

\"Minh<\/p>\n

CVE-2026-20253 l\u00e0 g\u00ec?<\/h2>\n

CVE-2026-20253 \u0111\u01b0\u1ee3c Splunk x\u1ebfp m\u1ee9c Critical<\/strong> v\u1edbi \u0111i\u1ec3m CVSS 9.8. Trong c\u00e1c phi\u00ean b\u1ea3n Splunk Enterprise 10.0 tr\u01b0\u1edbc 10.0.7 v\u00e0 10.2 tr\u01b0\u1edbc 10.2.4, m\u1ed9t ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng c\u1ea7n \u0111\u0103ng nh\u1eadp c\u00f3 th\u1ec3 t\u1ea1o ho\u1eb7c c\u1eaft ng\u1eafn t\u1ec7p t\u00f9y \u00fd th\u00f4ng qua endpoint c\u1ee7a PostgreSQL sidecar service n\u1ebfu endpoint n\u00e0y c\u00f3 th\u1ec3 b\u1ecb truy c\u1eadp qua m\u1ea1ng.<\/p>\n

Theo Splunk, nguy\u00ean nh\u00e2n tr\u1ef1c ti\u1ebfp l\u00e0 endpoint c\u1ee7a PostgreSQL sidecar thi\u1ebfu ki\u1ec3m so\u00e1t x\u00e1c th\u1ef1c, cho ph\u00e9p ng\u01b0\u1eddi d\u00f9ng c\u00f3 kh\u1ea3 n\u0103ng k\u1ebft n\u1ed1i m\u1ea1ng g\u1ecdi c\u00e1c thao t\u00e1c t\u1ec7p m\u00e0 kh\u00f4ng c\u1ea7n th\u00f4ng tin \u0111\u0103ng nh\u1eadp h\u1ee3p l\u1ec7. Splunk Enterprise 10.4 kh\u00f4ng b\u1ecb \u1ea3nh h\u01b0\u1edfng; Splunk Enterprise 9.4 v\u00e0 c\u00e1c phi\u00ean b\u1ea3n c\u0169 h\u01a1n c\u0169ng \u0111\u01b0\u1ee3c l\u00e0m r\u00f5 l\u00e0 kh\u00f4ng b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n

V\u00ec sao l\u1ed7i n\u00e0y nguy hi\u1ec3m v\u1edbi h\u1ec7 th\u1ed1ng doanh nghi\u1ec7p?<\/h2>\n

Splunk th\u01b0\u1eddng \u0111\u01b0\u1ee3c tri\u1ec3n khai trong m\u00f4i tr\u01b0\u1eddng trung t\u00e2m d\u1eef li\u1ec7u, \u0111\u1ed9i v\u1eadn h\u00e0nh b\u1ea3o m\u1eadt ho\u1eb7c h\u1ea1 t\u1ea7ng gi\u00e1m s\u00e1t l\u1edbn. N\u1ec1n t\u1ea3ng n\u00e0y x\u1eed l\u00fd log, s\u1ef1 ki\u1ec7n, c\u1ea3nh b\u00e1o v\u00e0 d\u1eef li\u1ec7u v\u1eadn h\u00e0nh t\u1eeb nhi\u1ec1u h\u1ec7 th\u1ed1ng tr\u1ecdng y\u1ebfu. V\u00ec v\u1eady, m\u1ed9t l\u1ed7i cho ph\u00e9p thao t\u00e1c t\u1ec7p kh\u00f4ng x\u00e1c th\u1ef1c c\u00f3 th\u1ec3 t\u1ea1o ra r\u1ee7i ro v\u01b0\u1ee3t xa ph\u1ea1m vi m\u1ed9t \u1ee9ng d\u1ee5ng \u0111\u01a1n l\u1ebb.<\/p>\n

Ph\u00e2n t\u00edch c\u1ee7a watchTowr Labs cho th\u1ea5y chu\u1ed7i t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 ti\u1ebfn xa h\u01a1n thao t\u00e1c t\u1ea1o t\u1ec7p, khi k\u1ebb t\u1ea5n c\u00f4ng l\u1ee3i d\u1ee5ng c\u00e1c endpoint li\u00ean quan \u0111\u1ebfn backup v\u00e0 restore c\u1ee7a PostgreSQL \u0111\u1ec3 ti\u1ebfn t\u1edbi kh\u1ea3 n\u0103ng th\u1ef1c thi m\u00e3 t\u1eeb xa trong m\u1ed9t s\u1ed1 \u0111i\u1ec1u ki\u1ec7n tri\u1ec3n khai. The Hacker News c\u0169ng nh\u1ea5n m\u1ea1nh r\u1eb1ng d\u00f9 ch\u01b0a c\u00f3 b\u1eb1ng ch\u1ee9ng khai th\u00e1c th\u1ef1c t\u1ebf, vi\u1ec7c chi ti\u1ebft k\u1ef9 thu\u1eadt \u0111\u00e3 \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 c\u00f3 th\u1ec3 l\u00e0m t\u0103ng nguy c\u01a1 qu\u00e9t v\u00e0 khai th\u00e1c c\u01a1 h\u1ed9i.<\/p>\n

\"S\u01a1<\/p>\n

C\u00e1c phi\u00ean b\u1ea3n b\u1ecb \u1ea3nh h\u01b0\u1edfng v\u00e0 b\u1ea3n v\u00e1<\/h2>\n

Theo advisory SVD-2026-0603 c\u1ee7a Splunk, c\u00e1c nh\u00e1nh b\u1ecb \u1ea3nh h\u01b0\u1edfng g\u1ed3m Splunk Enterprise 10.0.0 \u0111\u1ebfn 10.0.6<\/strong> and Splunk Enterprise 10.2.0 \u0111\u1ebfn 10.2.3<\/strong>. B\u1ea3n v\u00e1 t\u01b0\u01a1ng \u1ee9ng l\u00e0 10.0.7<\/strong> and 10.2.4<\/strong>. Splunk Enterprise 10.4 \u0111\u01b0\u1ee3c ghi nh\u1eadn kh\u00f4ng b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n

V\u1edbi t\u1ed5 ch\u1ee9c ch\u01b0a th\u1ec3 n\u00e2ng c\u1ea5p ngay, Splunk khuy\u1ebfn ngh\u1ecb v\u00f4 hi\u1ec7u h\u00f3a PostgreSQL sidecar service b\u1eb1ng c\u1ea5u h\u00ecnh trong server.conf. Tuy nhi\u00ean, bi\u1ec7n ph\u00e1p n\u00e0y kh\u00f4ng n\u00ean \u00e1p d\u1ee5ng t\u00f9y ti\u1ec7n n\u1ebfu h\u1ec7 th\u1ed1ng \u0111ang d\u00f9ng Edge Processor, OpAmp ho\u1eb7c SPL2 data pipelines, v\u00ec vi\u1ec7c t\u1eaft PostgreSQL c\u00f3 th\u1ec3 l\u00e0m gi\u00e1n \u0111o\u1ea1n c\u00e1c t\u00ednh n\u0103ng ph\u1ee5 thu\u1ed9c.<\/p>\n

\u0110i\u1ec3m c\u1ea7n l\u01b0u \u00fd cho \u0111\u1ed9i v\u1eadn h\u00e0nh<\/h2>\n

C\u00e1c t\u1ed5 ch\u1ee9c \u0111ang d\u00f9ng Splunk Enterprise n\u00ean ki\u1ec3m k\u00ea phi\u00ean b\u1ea3n th\u1ef1c t\u1ebf, x\u00e1c \u0111\u1ecbnh n\u01a1i tri\u1ec3n khai nh\u00e1nh 10.0 v\u00e0 10.2, \u0111\u1ed3ng th\u1eddi \u01b0u ti\u00ean v\u00e1 c\u00e1c m\u00e1y c\u00f3 giao di\u1ec7n qu\u1ea3n tr\u1ecb ho\u1eb7c d\u1ecbch v\u1ee5 li\u00ean quan c\u00f3 th\u1ec3 b\u1ecb truy c\u1eadp t\u1eeb m\u1ea1ng kh\u00f4ng tin c\u1eady. V\u1edbi m\u00f4i tr\u01b0\u1eddng l\u1edbn, c\u1ea7n r\u00e0 so\u00e1t c\u1ea3 c\u00e1c b\u1ea3n c\u00e0i th\u1eed nghi\u1ec7m, m\u00e1y lab, c\u1ee5m cloud t\u1ef1 qu\u1ea3n v\u00e0 instance \u0111\u00e3 b\u1ecb b\u1ecf qu\u00ean.<\/p>\n

\u0110\u1ed9i b\u1ea3o m\u1eadt c\u0169ng n\u00ean theo d\u00f5i log truy c\u1eadp b\u1ea5t th\u01b0\u1eddng t\u1edbi c\u00e1c \u0111\u01b0\u1eddng d\u1eabn li\u00ean quan PostgreSQL sidecar, ki\u1ec3m tra thay \u0111\u1ed5i t\u1ec7p l\u1ea1 trong th\u01b0 m\u1ee5c Splunk, v\u00e0 r\u00e0 so\u00e1t c\u1ea5u h\u00ecnh reverse proxy ho\u1eb7c firewall \u0111\u1ec3 gi\u1ea3m b\u1ec1 m\u1eb7t truy c\u1eadp. Trong b\u1ed1i c\u1ea3nh chi ti\u1ebft k\u1ef9 thu\u1eadt \u0111\u00e3 xu\u1ea5t hi\u1ec7n c\u00f4ng khai, t\u1ed1c \u0111\u1ed9 v\u00e1 v\u00e0 ph\u00e2n v\u00f9ng m\u1ea1ng v\u1eabn l\u00e0 hai bi\u1ec7n ph\u00e1p ph\u00f2ng th\u1ee7 quan tr\u1ecdng nh\u1ea5t.<\/p>\n

B\u00e0i h\u1ecdc r\u1ed9ng h\u01a1n t\u1eeb s\u1ef1 c\u1ed1<\/h2>\n

S\u1ef1 c\u1ed1 n\u00e0y cho th\u1ea5y r\u1ee7i ro kh\u00f4ng ch\u1ec9 \u0111\u1ebfn t\u1eeb ch\u1ee9c n\u0103ng ch\u00ednh c\u1ee7a m\u1ed9t n\u1ec1n t\u1ea3ng b\u1ea3o m\u1eadt, m\u00e0 c\u00f2n t\u1eeb c\u00e1c d\u1ecbch v\u1ee5 ph\u1ee5 tr\u1ee3 \u0111\u01b0\u1ee3c th\u00eam v\u00e0o \u0111\u1ec3 h\u1ed7 tr\u1ee3 v\u1eadn h\u00e0nh. Nh\u1eefng th\u00e0nh ph\u1ea7n sidecar, agent, service ph\u1ee5 ho\u1eb7c endpoint n\u1ed9i b\u1ed9 n\u1ebfu thi\u1ebfu x\u00e1c th\u1ef1c c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh \u0111i\u1ec3m y\u1ebfu nghi\u00eam tr\u1ecdng khi \u0111i v\u00e0o m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t.<\/p>\n

V\u1edbi doanh nghi\u1ec7p, b\u00e0i h\u1ecdc th\u1ef1c t\u1ebf l\u00e0 kh\u00f4ng n\u00ean m\u1eb7c \u0111\u1ecbnh r\u1eb1ng endpoint n\u1ed9i b\u1ed9 lu\u00f4n an to\u00e0n. M\u1ecdi th\u00e0nh ph\u1ea7n c\u00f3 kh\u1ea3 n\u0103ng thao t\u00e1c t\u1ec7p, ch\u1ea1y backup, restore ho\u1eb7c g\u1ecdi d\u1ecbch v\u1ee5 h\u1ec7 th\u1ed1ng c\u1ea7n \u0111\u01b0\u1ee3c ki\u1ec3m so\u00e1t x\u00e1c th\u1ef1c, ph\u00e2n quy\u1ec1n v\u00e0 gi\u1edbi h\u1ea1n m\u1ea1ng ch\u1eb7t ch\u1ebd nh\u01b0 c\u00e1c API c\u00f4ng khai.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb The Hacker News, Splunk advisory v\u00e0 watchTowr Labs<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Splunk Enterprise CVE-2026-20253 \u0111ang tr\u1edf th\u00e0nh m\u1ed9t v\u00ed d\u1ee5 \u0111\u00e1ng ch\u00fa \u00fd v\u1ec1 r\u1ee7i ro b\u1ea3o m\u1eadt trong c\u00e1c th\u00e0nh ph\u1ea7n ph\u1ee5 tr\u1ee3 c\u1ee7a n\u1ec1n t\u1ea3ng gi\u00e1m s\u00e1t d\u1eef li\u1ec7u. Theo advisory c\u1ee7a Splunk v\u00e0 ph\u00e2n t\u00edch k\u1ef9 thu\u1eadt \u0111\u01b0\u1ee3c The Hacker News t\u1ed5ng h\u1ee3p, l\u1ed7 h\u1ed5ng n\u1eb1m \u1edf m\u1ed9t endpoint c\u1ee7a d\u1ecbch v\u1ee5 PostgreSQL […]<\/p>\n","protected":false},"author":2,"featured_media":1644,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[185,34,186,36,187,184],"class_list":["post-1646","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-cve-2026-20253","tag-lo-hong-bao-mat","tag-postgresql","tag-rce","tag-siem","tag-splunk"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1646"}],"version-history":[{"count":2,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1646\/revisions"}],"predecessor-version":[{"id":1661,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1646\/revisions\/1661"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1644"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}