42
47
47
47
42
47
47
47
CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher
Apache Storm's setuid-root worker-launcher re-resolves paths during recursive chown/chmod, letting local users win a race to escalate to root.
CVE-2026-82429 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. The setuid-root worker-launcher walks worker directories with FTS calling lchown and chmod on full pathnames while running with effective uid 0, and both syscalls re-resolve the path at call time. A local attacker can exploit this time-of-check race by swapping path components to gain root privileges. Fixed in version 3.1.0.
36
42
42
47
47
60
60
47
42
47
47
60
42
42
60
47
47
42
47
60
47