--- title: "CVE-2026-20253 hits Splunk with active exploitation, os.cpu_count() breaks Kubernetes workers" url: https://daily.dev/posts/cve-2026-20253-hits-splunk-with-active-exploitation-os-cpu-count-breaks-kubernetes-workers-fdvamcyr7 source_url: https://daily.dev/posts/cve-2026-20253-hits-splunk-with-active-exploitation-os-cpu-count-breaks-kubernetes-workers-fdvamcyr7 type: freeform source: "Backend Digest" published: 2026-06-28T04:18:31.176Z updated: 2026-06-28T04:18:56.451Z tags: ["security", "python", "kubernetes", "logging", "spring"] reading_time: 5 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-20253 hits Splunk with active exploitation, os.cpu_count() breaks Kubernetes workers **[Backend Digest](https://daily.dev/sources/backend_digest)** · 5 min read · 1 upvotes · 0 comments ## Summary A CVSS 9.8 vulnerability (CVE-2026-20253) in Splunk Enterprise 10 is actively exploited — an unauthenticated attacker can write arbitrary files and achieve RCE via a bundled PostgreSQL sidecar with no authentication; CISA added it to the KEV catalog. Python's os.cpu_count() silently returns the host node's full CPU count inside cgroup-limited Kubernetes pods, causing Gunicorn to massively over-provision workers and degrade performance. An AI cost-routing case study shows a 60% inference cost reduction via a classifier-based router was wiped out 4-5x over by customer churn from quality degradation. Spring Framework introduces background bean initialization via @Bean(bootstrap=BACKGROUND) to reduce startup latency. Additional items cover Kafka CommitFailedException handling with virtual threads, AWS Workload Credentials Provider as a Vault Agent alternative, patchelf 0.19.0 ELF note cache for Nix, and Docker/Deno/Podman package updates. ## Content **TLDR:** A CVSS 9.8 vulnerability in Splunk Enterprise 10 is actively exploited — an unauthenticated attacker can write arbitrary files and escalate to RCE via a bundled PostgreSQL sidecar that ships with no auth. On the infrastructure side, Python's os.cpu_count() silently returns the node's full CPU count inside cgroup-limited pods, causing Gunicorn to spawn dozens of workers against a fraction of a CPU. The AI cost-routing story is worth reading: a team saved 60% on inference costs with a classifier-based router, then watched churn eat 4-5x that back over three months. Spring Framework's new background bean initialization and Kafka's CommitFailedException handling round out today's backend-relevant releases. --- ## CVE-2026-20253: Splunk Enterprise 10 ships unauthenticated PostgreSQL sidecar, active exploitation confirmed Splunk Enterprise 10 bundles a PostgreSQL sidecar that exposes file operations with zero authentication. An unauthenticated network attacker can create or truncate arbitrary files as the Splunk user, which is a straight path to RCE. CISA added it to the KEV catalog on June 18; active exploitation was confirmed the next day. Affected versions are 10.2 below 10.2.4 and 10.0 below 10.0.7 — Splunk 9.4 and earlier are not affected. Patch immediately; the interim mitigation is disabling the sidecar service. The broader lesson here is uncomfortable: modern appliance software silently ships bundled helper services that never show up in your inventory and get patched only on the vendor's schedule. [Read more](https://daily.dev/posts/Q51yVrEEb) ## os.cpu_count() returns node CPU count inside cgroup-limited Kubernetes pods, wrecking worker sizing Python's os.cpu_count() reads the host node's CPU count, not the cgroup quota. A pod with a 500m CPU limit on a 20-core node returns 20, so a standard Gunicorn formula like workers = cpu_count() * 2 + 1 spawns 41 workers against half a CPU. The benchmark numbers are stark: 1 worker handled 101 requests at ~1s median latency; 14 workers completed only 46 requests at ~6.4s median, with 83% of cgroup periods throttled. The fix is reading the actual quota from /sys/fs/cgroup/cpu.max (cgroup v2) or the CFS bandwidth files (cgroup v1) before sizing workers. If you're running Python services in Kubernetes with CPU limits, this is worth checking today. [Read more](https://daily.dev/posts/oJMK5mqIr) ## AI cost routing saved 60% on inference, then cost 4-5x that in churn A team built a classifier-based router to send simple queries to cheaper models and cut their monthly AI bill by roughly 60%. Three months later, customer satisfaction had dropped enough that churn wiped out 4-5x the savings. The failure modes are instructive: classifiers can't reliably detect long-tail query complexity from surface form, cheap models fail confidently on edge cases, and quality monitoring aggregated across tiers hid the tier-specific degradation until it was too late. The alternative they landed on is uncertainty-routed cascades — every query starts at the cheap model and escalates only when confidence is low — combined with per-tier quality monitoring and classifier confidence drift tracking. [Read more](https://daily.dev/posts/74kA47hYK) ## Spring Framework adds native background bean initialization to cut startup latency The new @Bean(bootstrap = BACKGROUND) attribute lets selected singleton beans initialize asynchronously during ApplicationContext refresh, decoupling expensive work like cache warming and connection pool setup from the main startup thread. Spring handles dependency safety by suspending resolution for beans that depend on still-initializing background beans; ObjectProvider covers deferred retrieval in early-access scenarios. Standard Spring lifecycle semantics are preserved, so this is a low-risk addition for services with slow startup paths. [Read more](https://daily.dev/posts/SaSQaXAE8) --- ## Also notable - **Kafka CommitFailedException: async processing with virtual threads and per-partition offset tracking:** When record processing exceeds MAX_POLL_INTERVAL_MS, the group coordinator reassigns partitions and the next commit throws CommitFailedException — the fix is either tuning MAX_POLL_INTERVAL_MS and MAX_POLL_RECORDS_CONFIG, or switching to async processing with virtual threads, a ConcurrentHashMap for committable offsets, and a ConsumerRebalanceListener to safely commit in-flight offsets during rebalances. [Read more](https://daily.dev/posts/5g3zp4iwO) - **AWS Workload Credentials Provider: open-source Vault Agent alternative for ACM and Secrets Manager:** AWS released an Apache-2.0 tool that automatically delivers, caches, and refreshes TLS certificates and Secrets Manager secrets, checks ACM certificates every 24 hours, and triggers reload commands for NGINX or Apache on update — positioned as a drop-in alternative to HashiCorp Vault Agent for AWS-native stacks. [Read more](https://daily.dev/posts/xmJi9ZEqZ) - **patchelf 0.19.0 ships ELF note cache to fix Nix's O(N×M) dynamic linker stat storm:** The stat storm in Nix — where the dynamic loader makes hundreds of failing openat() syscalls per program start due to long DT_RUNPATH lists — is addressed in patchelf 0.19.0 via a per-DSO ELF note cache, with a nixpkgs PR pending to enable it across the full package set. [Read more](https://daily.dev/posts/aCjj6IZku) - **Splunk package roundup: Docker Engine 29.6.0, Deno 2.9.0 desktop binaries, Podman CVE-2026-57231:** This week's package management roundup includes Docker Engine 29.6.0, Deno 2.9.0 with desktop binary compilation, Spack 1.2.0 with SBOM generation, and Podman CVE-2026-57231 (host environment variable leak) — worth a scan if you run Podman in CI. [Read more](https://daily.dev/posts/ZlIyGjn91) ## Similar posts on daily.dev - [CISA: Splunk Enterprise flaw actively exploited, patch by Sunday](https://daily.dev/posts/cisa-splunk-enterprise-flaw-actively-exploited-patch-by-sunday-z0vm1ip1q) · BleepingComputer · 0 upvotes · 0 comments - [Critical Splunk Enterprise Vulnerabilities Allow Unauthenticated File Operations and Remote Code Execution](https://daily.dev/posts/critical-splunk-enterprise-vulnerabilities-allow-unauthenticated-file-operations-and-remote-code-exe-bgqci6rdk) · Orca Security Blog · 0 upvotes · 0 comments - [How CVE-2026-20253 Turns Splunk’s PostgreSQL Sidecar Into an Open Door](https://daily.dev/posts/how-cve-2026-20253-turns-splunk-s-postgresql-sidecar-into-an-open-door-eoqau7eyh) · Latest Hacking News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#kubernetes](https://daily.dev/tags/kubernetes), [#logging](https://daily.dev/tags/logging), [#spring](https://daily.dev/tags/spring) [View this post on daily.dev](https://daily.dev/posts/cve-2026-20253-hits-splunk-with-active-exploitation-os-cpu-count-breaks-kubernetes-workers-fdvamcyr7)