CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher
Apache Storm's setuid-root worker-launcher re-resolves paths during recursive chown/chmod, letting local users win a race to escalate to root.
CVE-2026-82429 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. The setuid-root worker-launcher walks worker directories with FTS calling lchown and chmod on full pathnames while running with effective uid 0, and both syscalls re-resolve the path at call time. A local attacker can exploit this time-of-check race by swapping path components to gain root privileges. Fixed in version 3.1.0.
- Affects Apache Storm Worker Launcher 3.0.0 before 3.1.0
- TOCTOU race in setuid-root recursive lchown/chmod of worker directories
- Local attacker can escalate privileges to root
- CVEs
- CVE-2026-82429
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82429 | Time-of-Check Race in Apache Storm worker-launcher Allows Local Root Escalation | 7.8 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: important Affected versions: - Apache Storm Worker Launcher (org. apache. storm:storm-core) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.