Vulnerability · Published May 12, 2026 · Assigned by Cribl

CVE-2026-45393Local privilege escalation to SYSTEM in Cribl Edge for Windows

High 7.8

In plain English

A high-severity incorrect default permissions in Cribl Edge from Cribl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 87.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect default permissions on the Windows installer's authentication directory (CWE-276) expose a cryptographic secret used for JWT signing and password-hash derivation, enabling forgery of administrative API tokens. The forged token can then be used to invoke a pipeline function that reaches an OS command sink (CWE-78) running in the SYSTEM context.

Affected products (as reported)

Vendor	Product	Versions
Cribl	Cribl Edge	0 – before 4.17.1

Weakness: CWE-276, CWE-78, CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Cribl Edge 4.17.1 Security Fixes release-notes
Cribl Trust Portal vendor-advisory