Apache Storm 3.2.0 fixes two low-severity access flaws

1 source · 2 articlesFirst reported Nov 11, 2026 · 03:23 UTCUpdated Nov 11, 2026 · 03:25 UTC (17h ago)

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Apache Storm 3.0.0 before 3.2.0 has two low-severity flaws: a Logviewer file read and a DRPC impersonation bypass.

Apache disclosed two low-severity issues in Apache Storm 3.0.0 before 3.2.0, both posted by Rui Abreu on November 10. CVE-2026-124495 affects storm-webapp: Logviewer can serve files a worker, running as the topology owner, linked into its log directory, so a topology submitter may read other users' worker logs and other files the Logviewer process can read. The notice recommends an upgrade, but the stated fixed version is truncated in the post. CVE-2026-124496 affects storm-server: an authenticated client can pass doAsUser on the DRPC HTTP endpoint without the impersonation authorizer and run DRPC functions limited to another user. Apache says version 3.2.0 fixes that issue; Javier García Herrera is credited as the finder.

Key facts

CVE-2026-124495 affects org.apache.storm:storm-webapp 3.0.0 before 3.2.0.
A topology submitter can read files the Logviewer process can read.
Workers must run as the topology owner for that path.
CVE-2026-124496 affects org.apache.storm:storm-server; 3.2.0 is the fix.
Apache rates both issues low.
Javier García Herrera found the DRPC bypass.

Analyze CVE-2026-124495 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Nov 10, 2026Rui Abreu posted both Apache Storm notices · oss-security

What each outlet adds

beyond the shared facts

oss-securityLogviewer symlink read; fixed version line truncated
oss-securityDRPC doAsUser bypass fixed in storm-server 3.2.0

CVEs: CVE-2026-124495 CVE-2026-124496

Vendors: Apache
Products: Apache Storm

Coverage

oldest first · one row per article · UTC

03:23 UTC · 17h ago oss-securityFirst report
Apache Storm Logviewer follows worker symlinks across ACLs (CVE-2026-124495)
A topology submitter can read other users' worker logs and other files the Logviewer process can read.
03:25 UTC · 17h ago oss-security
Apache Storm DRPC doAsUser skips impersonation checks (CVE-2026-124496)
An authenticated Storm client can run DRPC functions limited to another user; 3.2.0 fixes storm-server.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-124495 +1 related CVE CVE-2026-124496	Logviewer symlink read in Apache Storm across topology ACLs	—	—		7h ago