CrowdStrike LogScale - Critical Path Traversal Vulnerability

What Happened

CrowdStrike has issued an urgent security advisory regarding a critical unauthenticated path-traversal vulnerability (CVE-2026-40050) in its LogScale platform. This flaw allows remote attackers to read arbitrary files from the server's filesystem without needing any authentication. The vulnerability is located in a specific cluster API endpoint within LogScale.

How It Works

If the vulnerable endpoint is exposed, attackers can traverse the server's directory structure. This means they can potentially access sensitive files, which poses a significant risk to the confidentiality, integrity, and availability of the data stored on the server.

What's at Risk

Patch Status

CrowdStrike has proactively deployed network-layer blocks for LogScale SaaS customers, mitigating the risk at the infrastructure level. For self-hosted customers, it is crucial to upgrade to one of the patched versions immediately:

• 1.235.1 or later
• 1.234.1 or later
• 1.233.1 or later
• 1.228.2 (LTS) or later

CrowdStrike confirmed that these updates introduce no performance impact on LogScale operations.

What You Should Do

Organizations running self-hosted instances should follow standard incident response procedures to monitor for any signs of unauthorized access or file exfiltration. CrowdStrike is actively monitoring LogScale SaaS environments for any suspicious activity related to this vulnerability. As of now, there is no evidence of exploitation in the wild, as the vulnerability was discovered internally through continuous product testing.