Search: “worker-launcher”

2 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

SeverityAll critical 0 high 2 medium 0 low 0 info 0

CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Setuid-root Apache Storm worker-launcher chowns worker directory to the tenant before reading its command file, enabling local root privilege escalation.

CVE-2026-82430 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. When launching Docker or OCI workers, the setuid-root worker-launcher transfers ownership of the entire worker directory to the untrusted topology user before reading and acting on the supervisor-written command file in that directory. An untrusted tenant can tamper with the command file to achieve local privilege escalation to root. Fixed in version 3.1.0.

oss-securitySep 13, 14:26 UTC · 2d agoVulnerability CVE-2026-82430

CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

Apache Storm's setuid-root worker-launcher re-resolves paths during recursive chown/chmod, letting local users win a race to escalate to root.

CVE-2026-82429 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. The setuid-root worker-launcher walks worker directories with FTS calling lchown and chmod on full pathnames while running with effective uid 0, and both syscalls re-resolve the path at call time. A local attacker can exploit this time-of-check race by swapping path components to gain root privileges. Fixed in version 3.1.0.

oss-securitySep 13, 14:25 UTC · 2d agoVulnerability CVE-2026-82429