CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
Setuid-root Apache Storm worker-launcher chowns worker directory to the tenant before reading its command file, enabling local root privilege escalation.
CVE-2026-82430 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. When launching Docker or OCI workers, the setuid-root worker-launcher transfers ownership of the entire worker directory to the untrusted topology user before reading and acting on the supervisor-written command file in that directory. An untrusted tenant can tamper with the command file to achieve local privilege escalation to root. Fixed in version 3.1.0.
- Affects Apache Storm Worker Launcher 3.0.0 before 3.1.0
- Setuid-root binary chowns directory to tenant before parsing command file
- Untrusted topology user can rewrite the file for root code execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82430 | TOCTOU Root Privilege Escalation in Apache Storm worker-launcher (Docker/OCI Workers) | 7.8 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: important Affected versions: - Apache Storm Worker Launcher (org. apache. storm:storm-core) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.