CVE-2026-82430

Apache Storm's setuid-root worker-launcher contains a time-of-check-to-time-of-use race (CWE-367) when starting Docker or OCI workers: it first chowns the entire worker directory to the untrusted topology user and only then reads the supervisor's command file from that same directory, opening it without O_NOFOLLOW and without re-verifying its owner, so the tenant can swap the file's contents in that window. On the Docker path the rewritten command executes with real uid 0 and the argument sanitiser is not a privilege boundary — it admits -v with an arbitrary host source, --device, --cap-add, --security-opt, --user and --net — yielding an attacker-authored, root-equivalent container invocation with the host filesystem available. The OCI path has the same rewrite window with only structural mount validation and no source/destination allow-list, allowing arbitrary host paths to be bind-mounted read-write into the container, and the attacker-settable username field (checked only against non-root and minimum-uid rules) permits execution as another tenant's uid. Affected installations are Apache Storm clusters prior to 3.1.0 that use Docker or OCI worker isolation where topology submitters are not fully trusted; exploitation requires the attacker to already have topology-submission/tenant access on the cluster, so this is a local privilege escalation rather than a remote attack. No CVSS score has been assigned, no public proof of concept is known, the issue is not in the CISA KEV, and there is no evidence of in-the-wild exploitation.

What to do: Upgrade to Apache Storm 3.1.0 and then rebuild and reinstall the setuid worker-launcher binary on every supervisor node — the fix is not effective until the launcher is reinstalled. If immediate upgrade is not possible, disable Docker and OCI worker isolation, or restrict topology submission on affected supervisors to trusted principals only. Operators should also review worker nodes for unexpected root-run containers, suspicious read-write bind mounts of host paths, and topology submissions from non-trusted accounts.