CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
Apache Storm Logviewer ignores logs.users and logs.groups ACLs for daemon logs, letting unauthorized users read sensitive logs.
CVE-2026-82437 (severity: moderate) affects Apache Storm Logviewer (storm-webapp) versions 3.0.0 before 3.1.0. The Logviewer offers logs.users and logs.groups settings for operators to control who may read log content, but for daemon logs the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer. As a result, configured access controls were not enforced and unauthorized users could read daemon log content.
- CVE-2026-82437 rated moderate by Apache
- Affects Apache Storm Logviewer 3.0.0 before 3.1.0
- logs.users and logs.groups ACLs bypassed for daemon logs
- Unauthorized users can read potentially sensitive daemon logs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82437 | Missing Authorization in Apache Storm Logviewer Exposes Daemon Logs | 4.3 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: moderate Affected versions: - Apache Storm Logviewer (org. apache. storm:storm-webapp) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.