oss-securitypublished Sep 13, 14:37 UTC (2d ago)ingested Sep 13, 14:57 UTC

CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

lowVulnerabilityimportance 25CVE-2026-82437

AI summary · glm-5.3

Apache Storm Logviewer ignores logs.users and logs.groups ACLs for daemon logs, letting unauthorized users read sensitive logs.

CVE-2026-82437 (severity: moderate) affects Apache Storm Logviewer (storm-webapp) versions 3.0.0 before 3.1.0. The Logviewer offers logs.users and logs.groups settings for operators to control who may read log content, but for daemon logs the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer. As a result, configured access controls were not enforced and unauthorized users could read daemon log content.

CVE-2026-82437 rated moderate by Apache
Affects Apache Storm Logviewer 3.0.0 before 3.1.0
logs.users and logs.groups ACLs bypassed for daemon logs
Unauthorized users can read potentially sensitive daemon logs

Read the original

Tagsapache storm logviewer access-control information-disclosure cve-2026-82437

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-82437	Missing Authorization in Apache Storm Logviewer Exposes Daemon Logs Apache Storm's Logviewer component fails to enforce its configured logs.users and logs.groups authorization on daemon logs: the access check discards the authorizer's verdict whenever the 'daemon log' flag is set, and the daemon log page and download endpoints reach the handler without consulting an authorizer at all. Any user who can pass the configured servlet filter can therefore read nimbus.log, supervisor.log, and other daemon logs on every reachable node, which contain other tenants' topology names, owners, and configuration fragments. The advisory also covers the listing endpoints /listLogs and /searchLogs, which accept a user argument but never apply it, returning every tenant's topology and worker log file names (metadata only). There was no configuration that closed either behavior; the issue is fixed in Apache Storm 3.1.0. No public proof of concept is known and there is no evidence of in-the-wild exploitation. Do: Upgrade to Apache Storm 3.1.0, where daemon log paths enforce the same configured user and group lists as worker log paths and listing endpoints filter by the requesting user. If immediate upgrade is not possible, place the Logviewer behind a reverse proxy that restricts the daemon log endpoints and treat daemon log content as readable by any filter-authenticated user. Review daemon log access history for unexpected readers, and check whether multi-tenant topology names, owners, or configuration fragments were exposed.	4.3	—		Apache Storm (Logviewer component) all versions prior to 3.1.0	nichelikely hundreds to low thousands of Storm clusters, with only a subset exposing Logviewer beyond trusted networks	1d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-82437

Missing Authorization in Apache Storm Logviewer Exposes Daemon Logs

Apache Storm's Logviewer component fails to enforce its configured logs.users and logs.groups authorization on daemon logs: the access check discards the authorizer's verdict whenever the 'daemon log' flag is set, and the daemon log page and download endpoints reach the handler without consulting an authorizer at all. Any user who can pass the configured servlet filter can therefore read nimbus.log, supervisor.log, and other daemon logs on every reachable node, which contain other tenants' topology names, owners, and configuration fragments. The advisory also covers the listing endpoints /listLogs and /searchLogs, which accept a user argument but never apply it, returning every tenant's topology and worker log file names (metadata only). There was no configuration that closed either behavior; the issue is fixed in Apache Storm 3.1.0. No public proof of concept is known and there is no evidence of in-the-wild exploitation.

Do: Upgrade to Apache Storm 3.1.0, where daemon log paths enforce the same configured user and group lists as worker log paths and listing endpoints filter by the requesting user. If immediate upgrade is not possible, place the Logviewer behind a reverse proxy that restricts the daemon log endpoints and treat daemon log content as readable by any filter-authenticated user. Review daemon log access history for unexpected readers, and check whether multi-tenant topology names, owners, or configuration fragments were exposed.

4.3

—

Apache Storm (Logviewer component) all versions prior to 3.1.0

nichelikely hundreds to low thousands of Storm clusters, with only a subset exposing Logviewer beyond trusted networks

1d ago

Full article

Posted by Richard Zowalla on Sep 13 Severity: moderate Affected versions: - Apache Storm Logviewer (org.apache.storm:storm-webapp) 3.0.0 before 3.1.0 Description: Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

This source does not provide full text. Read it at seclists.org.