Apache Storm Logviewer follows worker symlinks across ACLs (CVE-2026-124495)
A topology submitter can read other users' worker logs and other files the Logviewer process can read.
Stories per day · 30 days
Relatedinformation-disclosure2nimbus2authorization1client1deserialization1drpc1impersonation1logviewer1multi-tenant1symlink1
14 stories, newest first · one card per story
Stories tagged #apache-storm
Apache Storm Nimbus vulnerability allows submitter-controlled class instantiation
Apache Storm Nimbus before 3.1.0 treats unset scheduler strategy whitelist as allow any class, enabling arbitrary class instantiation.
Apache Storm Client vulnerability allows deserialization of untrusted state store data
Apache Storm Client before 3.1.0 deserializes untrusted data from state store with disabled Kryo class registration, enabling arbitrary code execution.
Re: CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
Follow-up on oss-security asks why CVE-2026-82434, Apache Storm ZooKeeper credential disclosure to read-only users and logs, lacks a severity rating.
CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
Apache Storm Nimbus/UI 3.0.0 leaks unredacted merged daemon configuration through the topology page, exposing secrets to UI users.
CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
Unvalidated topology dependency keys in Apache Storm Nimbus 3.0.0 enable cross-tenant blob deletion and cluster denial of service.
CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Unauthenticated DRPC requests to Apache Storm 3.0.0 cause unbounded memory growth in the function-name queue map, enabling DoS.
CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins
Three CORS misconfigurations in Apache Storm 3.0.0 let malicious web pages from arbitrary origins read authenticated API responses.
CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
Apache Storm Logviewer ignores logs.users and logs.groups ACLs for daemon logs, letting unauthorized users read sensitive logs.
CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Apache Storm Client 3.0.0 ACL bypass lets every authenticated principal bypass restrictions when nimbus.groups is set without nimbus.users.
CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
Setuid-root Apache Storm worker-launcher chowns worker directory to the tenant before reading its command file, enabling local root privilege escalation.
CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher
Apache Storm's setuid-root worker-launcher re-resolves paths during recursive chown/chmod, letting local users win a race to escalate to root.
CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys
Apache Storm stores shared dependency jars under predictable Maven-derived blob keys, allowing one tenant to substitute jars other tenants execute.
CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name
Unsanitised topology.blobstore.map local names in Apache Storm enable path traversal writes on supervisors as the supervisor user.