Apache Storm Logviewer follows worker symlinks across ACLs (CVE-2026-124495)
A topology submitter can read other users' worker logs and other files the Logviewer process can read.
Stories per day · 30 days
1 RSS
2 stories, newest first · one card per story
Stories tagged #logviewer
CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
Apache Storm Logviewer ignores logs.users and logs.groups ACLs for daemon logs, letting unauthorized users read sensitive logs.