Is CVE-2026-124495 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124495 being exploited in the wild.

How severe is CVE-2026-124495?

Informational severity, published 11 November 2026.

Is there a fix for CVE-2026-124495?

Yes: fixed in 3.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124495 attacked?

It is attacked with local access.

Am I affected by CVE-2026-124495?

Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124495: Apache Storm Logviewer symlink traversal in worker logs

CVE-2026-124495 · Severity: info · Published 2026-11-11

Apache Storm is a distributed real-time computation system used for processing data streams. When workers run under the topology owner's credentials, the Logviewer component can be tricked into serving arbitrary files as if they were worker logs through symlink manipulation. An attacker with topology submission rights can read sensitive worker logs from other users' topologies and other files accessible to the Logviewer process.

Technologies: Apache Storm. Vendors: Apache.

Quick answers

Is CVE-2026-124495 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124495 being exploited in the wild.
How severe is CVE-2026-124495?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Apache Storm before 3.2.0.
Is there a fix for CVE-2026-124495?: Yes: fixed in 3.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124495 attacked?: It is attacked with local access.
Am I affected by CVE-2026-124495?: Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.2.0

Technical details

The vulnerability is a symlink traversal issue in Apache Storm's Logviewer component. When workers execute as the topology owner, an attacker can place symlinks in their own worker log directory that point to other files. The Logviewer then serves these symlinked files as log content without proper validation. Exploitation requires the ability to submit topologies and relies on the worker process having read access to sensitive files.

Affected products

Apache Storm before 3.2.0

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.