CrowdStrike LogScale Unauthenticated Path Traversal

published 2026-04-21 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-24164

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits: 0; none known

CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability (CVE-2026-40050) in LogScale. This vulnerability only requires mitigation by customers that host specific versions of LogScale and does not affect Next-Gen SIEM customers. The vulnerability exists in a specific cluster API endpoint that, if exposed, allows a remote attacker to read arbitrary files from the server filesystem without authentication.

Next-Gen SIEM customers are not affected and do not need to take any action. CrowdStrike mitigated the vulnerability for LogScale SaaS customers by deploying network-layer blocks to all clusters on April 7, 2026. We have proactively reviewed all log data and there is no evidence of exploitation.

LogScale Self-hosted customers should upgrade to a patched version immediately to remediate the vulnerability.

CrowdStrike identified this vulnerability during continuous and ongoing product testing.

Patch / fix

fixed in 1

CrowdStrike LogScale Self-Hosted 1.233.1, 1.234.1, 1.235.1, 1.228.2

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 6 mo ago (2026-04-21)

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

CrowdStrike LogScale Self-Hosted

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

crowdstrike.com /en-us/security-advisories/cve-2026-40050/

Sources

CVE List CVE-2026-40050
NVD CVE-2026-40050

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary