CrowdStrike: CrowdStrike LogScale Vulnerability Allows Remote Attackers to Read Arbitrary Files from Server

Critical Path-Traversal Vulnerability in CrowdStrike LogScale Exposes Sensitive Files

CrowdStrike has disclosed a critical unauthenticated path-traversal vulnerability (CVE-2026-40050) in its LogScale platform, allowing remote attackers to read arbitrary files from affected servers without authentication. The flaw, rated 9.8 (CRITICAL) on the CVSS v3.1 scale, stems from two weaknesses: CWE-306 (Missing Authentication for Critical Function) and CWE-22 (Improper Pathname Limitation).

The vulnerability resides in a cluster API endpoint within LogScale Self-Hosted versions 1.224.0–1.234.0 (GA) and 1.228.0–1.228.1 (LTS). If exposed, attackers could traverse the server’s directory structure to access sensitive files. LogScale SaaS customers and Next-Gen SIEM users are unaffected, as CrowdStrike deployed network-layer mitigations across all SaaS clusters on April 7, 2026, and found no evidence of exploitation.

Discovered internally through CrowdStrike’s product testing program, the flaw has no known active exploitation in the wild. The company continues to monitor SaaS environments for suspicious activity.

Affected organizations running self-hosted LogScale instances are advised to upgrade immediately to one of the following patched versions:

• 1.235.1 or later
• 1.234.1 or later
• 1.233.1 or later
• 1.228.2 (LTS) or later

CrowdStrike confirmed that the updates introduce no performance impact on LogScale operations. Self-hosted users should also review logs for signs of unauthorized access or file exfiltration.

Source: https://cybersecuritynews.com/crowdstrike-logscale-vulnerability/

CrowdStrike cybersecurity rating report: https://www.rankiteo.com/company/crowdstrike

"id": "CRO1776846395",
"linkid": "crowdstrike",
"type": "Vulnerability",
"date": "4/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Cybersecurity',
                        'name': 'CrowdStrike LogScale Self-Hosted Users',
                        'type': 'Organization'}],
 'attack_vector': 'Remote',
 'customer_advisories': 'Advisory issued to self-hosted LogScale users',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Arbitrary files (sensitive '
                                             'data)'},
 'date_detected': '2026-04-07',
 'description': 'CrowdStrike has disclosed a critical unauthenticated '
                'path-traversal vulnerability (CVE-2026-40050) in its LogScale '
                'platform, allowing remote attackers to read arbitrary files '
                'from affected servers without authentication. The flaw, rated '
                '9.8 (CRITICAL) on the CVSS v3.1 scale, stems from two '
                'weaknesses: CWE-306 (Missing Authentication for Critical '
                'Function) and CWE-22 (Improper Pathname Limitation). The '
                'vulnerability resides in a cluster API endpoint within '
                'LogScale Self-Hosted versions 1.224.0–1.234.0 (GA) and '
                '1.228.0–1.228.1 (LTS). If exposed, attackers could traverse '
                'the server’s directory structure to access sensitive files. '
                'LogScale SaaS customers and Next-Gen SIEM users are '
                'unaffected.',
 'impact': {'data_compromised': 'Sensitive files',
            'systems_affected': 'LogScale Self-Hosted servers'},
 'investigation_status': 'Ongoing monitoring for exploitation',
 'post_incident_analysis': {'corrective_actions': 'Patches released and '
                                                  'network-layer mitigations '
                                                  'deployed',
                            'root_causes': 'CWE-306 (Missing Authentication '
                                           'for Critical Function) and CWE-22 '
                                           '(Improper Pathname Limitation)'},
 'recommendations': 'Upgrade to patched versions (1.235.1+, 1.234.1+, '
                    '1.233.1+, 1.228.2 LTS+) and review logs for unauthorized '
                    'access.',
 'references': [{'source': 'CrowdStrike Advisory'}],
 'response': {'communication_strategy': 'Public disclosure and advisory',
              'containment_measures': 'Network-layer mitigations deployed for '
                                      'SaaS clusters',
              'enhanced_monitoring': 'Monitoring for suspicious activity in '
                                     'SaaS environments',
              'remediation_measures': 'Patches released for self-hosted '
                                      'versions (1.235.1+, 1.234.1+, 1.233.1+, '
                                      '1.228.2 LTS+)'},
 'title': 'Critical Path-Traversal Vulnerability in CrowdStrike LogScale '
          'Exposes Sensitive Files',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2026-40050 (Path-Traversal)'}