Apache Storm Logviewer follows worker symlinks across ACLs (CVE-2026-124495)
A topology submitter can read other users' worker logs and other files the Logviewer process can read.
36
CVE-2026-124495
Logviewer symlink read in Apache Storm across topology ACLs
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Storm's Logviewer follows symlinks that a worker places in its own log directory when workers run as the topology owner. A user allowed to submit topologies can read other users' worker logs and other files the Logviewer process can read. Clusters using that worker setup are affected. Upgrade to 3.2.0 fixes it.
What to do: Upgrade Apache Storm to 3.2.0, which fixes the Logviewer symlink issue.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Storm | — | 3.2.0 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue.
- Weakness
- CWE-59