As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
Apache Storm Worker Launcher versions before 3.1.0 contain a local privilege escalation vulnerability in which the setuid-root worker-launcher changes directory ownership to an untrusted topology user before reading the command file, allowing that user to modify the file and gain root access. The flaw affects Docker and OCI worker launches in versions 3.0.0 and earlier.
Why it matters: Organizations running Apache Storm 3.0.0 or earlier for distributed stream processing face local privilege escalation risk if untrusted topology users can access worker nodes; upgrade to 3.1.0 or later to patch this root-level exposure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
Apache Storm Worker Launcher versions 3.0.0 before 3.1.0 contain a local privilege escalation vulnerability in which the setuid-root worker-launcher process changes ownership of the worker directory to an untrusted topology user before reading the command file, allowing an attacker to modify the command file and execute arbitrary commands as root. The vulnerability affects Docker and OCI worker deployments.
Why it matters: Organizations running Apache Storm 3.0.0 to 3.0.x with untrusted or multi-tenant topologies face root-level code execution risk from local attackers who can alter worker startup commands; upgrade to 3.1.0 or later.
- Source published
- First seen by Cybersecurity Tracker