CVE Intelligence
Analysis AI-assisted

CVE-2026-40050: CrowdStrike LogScale Unauthenticated Path Traversal

CrowdStrike disclosed CVE-2026-40050, a critical unauthenticated path traversal flaw in LogScale that could let a remote attacker read arbitrary files from the server when a specific cluster API endpoint is exposed. According to the vendor, Next-Gen SIEM customers are not affected, SaaS clusters received network-layer blocks, and self-hosted customers should upgrade to a patched version. The record does not list affected or fixed version ranges.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CrowdStrike published advisory CVE-2026-40050 describing a critical path traversal weakness (CWE-22) in LogScale. The flaw can be reached without authentication through a specific cluster API endpoint when that endpoint is exposed.

Impact

  • A remote attacker who can reach the affected endpoint could read arbitrary files from the server filesystem, according to the vendor description.
  • The record assigns a CVSS base score of 9.8 (critical) from the CNA.
  • The vendor text describes file reads only. Any wider impact on integrity or availability is unknown from the available information.

Affected products and versions

  • The vendor states that LogScale self-hosted deployments running specific versions must take action.
  • The vendor states that Next-Gen SIEM customers are not affected.
  • The record does not list affected or fixed version ranges. Check the CrowdStrike advisory for version details.

Exploitation status

  • The vendor reports it proactively reviewed log data and found no evidence of exploitation.
  • The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Self-hosted operators should upgrade to a patched LogScale version as advised by the vendor. The specific patched version is not stated in the record.
  • SaaS customers received network-layer blocks on all clusters, deployed by the vendor on April 7, 2026.
  • Until patched, restrict network access to LogScale cluster interfaces to trusted networks. This is general defensive practice rather than a vendor instruction.

Detection guidance

  • Review access and reverse proxy logs for unusual requests to LogScale cluster API paths from untrusted sources.
  • Verify whether cluster API endpoints are reachable from the internet or from untrusted network segments.
  • Prioritize self-hosted deployments that have not yet been updated.

Limitations of the available information

  • The record does not name the affected endpoint, the affected versions, or the patched releases.
  • The EPSS date in the record (2026-10-13) is later than the publication date (2026-04-21), so the EPSS values should be treated with caution.
  • This analysis relies on the vendor statement and the fields in the record only.

Frequently asked questions

Is CVE-2026-40050 being actively exploited?

The record does not list this CVE in CISA KEV, and the vendor reports no evidence of exploitation in its log review. No confirmed exploitation appears in the sources consulted.

Am I affected if I use Next-Gen SIEM?

According to the vendor, Next-Gen SIEM customers are not affected and do not need to take action.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.