CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

The setuid-root worker-launcher binary in Apache Storm walks worker directory trees using FTS and invokes lchown and chmod on full pathnames while running with effective uid 0, and because both syscalls re-resolve the path after FTS has classified each entry, an untrusted topology user can replace an intermediate directory component with a symbolic link and redirect root-owned ownership/permission changes at arbitrary files on the host (a CWE-367 time-of-check race, the same defect class as the Hadoop container-executor issues this code derives from). The race is cheap to retry: crashing a worker forces a relaunch and blob updates re-run the walk, so failed attempts cost the attacker nothing. Successful exploitation yields root on the supervisor node, breaking the isolation boundary that supervisor.run.worker.as.user and container isolation are intended to enforce. All versions prior to 3.1.0 are affected where the launcher is installed setuid-root and untrusted topology code runs on supervisors. There is no CVSS score yet, no known public proof of concept, and no evidence of exploitation in the wild.

Do: Upgrade to Apache Storm 3.1.0 and rebuild and reinstall the worker-launcher binary on every supervisor — replacing the Java artifacts alone leaves the vulnerable setuid binary in place. Until patched, do not run untrusted topology code on supervisors configured with supervisor.run.worker.as.user. Verify the launcher version and setuid permissions on each supervisor, and audit worker directories and host files for unexpected symbolic links or ownership/permission changes.