Cribl Edge for Windows versions before 4.17.1 contain a chain of vulnerabilities that enables a local authenticated user to gain SYSTEM privileges. The issue originates from incorrect default permissions on the Windows installer’s authentication directory, which expose a cryptographic secret used for JWT signing and password‑hash derivation. An attacker can forge administrative API tokens and then invoke a pipeline function that executes commands through an OS command sink. This results in a full privilege escalation to the SYSTEM account, allowing arbitrary command execution and complete host compromise.

The affected product is Cribl Edge for Windows. All installations running any version earlier than 4.17.1 are potentially impacted because the insecure permissions and token forgery flaw exist only before that release. Upgrading to version 4.17.1 or later removes the vulnerability.

The CVSS score of 8.5 indicates a high‑severity flaw. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local authenticated user who can access the Edge service; by forging a token the attacker can trigger pipeline functions that reach an OS command sink, resulting in the execution of arbitrary commands with SYSTEM privileges.