Vulnerabilities happen. What matters is what you do next.
Today, Cribl is officially a CVE Numbering Authority (CNA). That means we can assign CVE IDs and publish CVE Records for vulnerabilities in Cribl products.
Our scope is focused and intentional: on-premises Cribl Stream and Cribl Edge.
If you run Stream or Edge on your own infrastructure, this is for you.
Building ethical software requires transparency
Giving your security teams standardized visibility into real security issues helps you make informed decisions and take action quickly.
Security teams cannot manage what they cannot track. CVEs are the shared language that vulnerability management tools, scanners, and programs run on.
When we publish a CVE, your internal processes activate the right way. Tickets get created. Exceptions get documented. Patch SLAs get enforced. Everyone speaks the same identifier.
What a CNA does, in plain English
Being a CNA means we can:
Assign CVE IDs for in scope vulnerabilities in our products
Coordinate responsible disclosure with researchers and customers
Publish the CVE record context on Cribl’s Trust Portal Notifications Center.
What you can expect from Cribl CVEs
When Cribl publishes a CVE for on-prem Cribl Stream or Edge, you should expect:
A clear description of impact and conditions.
Affected versions and fixed versions.
Severity scoring and rationale to include CVSSv4, EPSS, and CWE classification.
References to release notes.
How responsible disclosure works with us
If you are a security researcher, partner, or customer and you find something:
Report it to Cribl through our responsible disclosure program.
Cribl’s Security Team will confirm receipt and start triage.
If it is eligible, we will assign a CVE ID as the CNA.
We will coordinate disclosure timing, publish the CVE record, ship the fix, and credit the researcher.
Bottom line
Becoming a CNA is an operational responsibility.
Cribl will self-publish vulnerabilities for on-prem Cribl Stream and Cribl Edge, with detailed CVEs and clear upgrade guidance.
Security maturity is not about pretending vulnerabilities do not exist. It is about handling them well.
For more details on how Cribl builds secure software, refer to: Cribl’s Blueprint for Secure Software Development.
