Apache Storm Logviewer follows worker symlinks across ACLs (CVE-2026-124495)
Original title: CVE-2026-124495: Apache Storm: Logviewer follows worker symlinks across topology ACLs
A topology submitter can read other users' worker logs and other files the Logviewer process can read.
Apache rated CVE-2026-124495 low. In storm-webapp 3.0.0 before 3.2.0, Logviewer serves files that a worker, running as the topology owner, linked into its own log directory. A user allowed to submit topologies can read other users' worker logs and other files the Logviewer process can read. The notice recommends an upgrade; the fixed version is cut off in this post.
Unconfirmed: The upgrade sentence is truncated, so the exact fixed version is not visible here.
- The affected artifact is org.apache.storm:storm-webapp.
- Workers must be running as the topology owner for the described path.
- Rui Abreu posted the report on November 10.
- Apache's stated severity is low.
Impact: Read other users' logs and files Logviewer can read
| Product | Affected |
|---|---|
| Apache Storm | 3.0.0 before 3.2.0 |
- 1.Upgrade Apache Storm storm-webapp; affected releases are before 3.2.0.
- CVEs
- CVE-2026-124495
- Vendors
- Apache
- Products
- Apache Storm
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124495 | Logviewer symlink read in Apache Storm across topology ACLs | — | — |
From the original article
Posted by Rui Abreu on Nov 10 Severity: low Affected versions: - Apache Storm (org. apache. storm:storm-webapp) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.