Path TraversalWeakness · CWE-22

CVE-2026-40050

CRITICAL · 9.8 CVSS v3.1 Published 2026-04-21
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability (CVE-2026-40050) in LogScale. This vulnerability only requires mitigation by customers that host specific versions of LogScale and does not affect Next-Gen SIEM customers. The vulnerability exists in a specific cluster API endpoint that, if exposed, allows a remote attacker to read arbitrary files from the server filesystem without authentication. Next-Gen SIEM customers are not affected and do not need to take any action. CrowdStrike mitigated the vulnerability for LogScale SaaS customers by deploying network-layer blocks to all clusters on April 7, 2026. We have proactively reviewed all log data and there is no evidence of exploitation. LogScale Self-hosted customers should upgrade to a patched version immediately to remediate the vulnerability. CrowdStrike identified this vulnerability during continuous and ongoing product testing.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A critical unauthenticated path traversal vulnerability (CVSS 9.8) exists in specific LogScale cluster API endpoints. When exposed, this flaw allows remote attackers to read arbitrary files from the server filesystem without any authentication, potentially exposing sensitive system data.

MitigationSelf-hosted LogScale customers must upgrade to the patched version immediately. SaaS customers are already protected via network-layer blocks deployed on April 7, 2026. Next-Gen SIEM customers are unaffected.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Locate LogScale installation and version
    Identify the LogScale installation directory and determine the installed version by checking version files, about pages, or running 'docker ps' if containerized. Common locations include /opt/humio or check the running service version.
    Affected if Running a self-hosted LogScale version that is older than the patched version released after April 2026
  2. Verify cluster API is enabled
    Check LogScale configuration files (such as humio-config.yaml or similar) for the presence and configuration of cluster API settings. Look for directives related to cluster API endpoints or the cluster controller.
    Affected if The cluster API functionality is enabled in the LogScale configuration
  3. Assess network exposure of cluster API
    Review firewall rules, reverse proxy configurations, and LogScale network bindings to determine if the cluster API ports (typically ports 8080, 8081, or custom configured ports) are accessible from untrusted networks or the public internet.
    Affected if The cluster API endpoints are exposed to untrusted network segments or the internet without authentication controls
  4. Check for unauthorized file access attempts
    Review LogScale audit logs and system access logs for unusual path traversal patterns such as '../' sequences or access to sensitive system files like /etc/passwd, /etc/shadow, or configuration directories.
    Affected if Logs show suspicious path traversal requests targeting the cluster API endpoints

You are affected if you run a self-hosted LogScale installation with the cluster API enabled and exposed to untrusted networks, and your version predates the patched release.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Self-hosted LogScale customers must upgrade to the patched version immediately. SaaS customers are already protected via network-layer blocks deployed on April 7, 2026. Next-Gen SIEM customers are unaffected.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-40050 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-40050 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data