CVE-2026-82429: Apache Storm worker-launcher privilege escalation via symlink attack

CVE-2026-82429 · Severity: high · CVSS 7.8 · Published 2026-09-14

Apache Storm is a distributed real-time data processing system. The setuid-root worker-launcher binary contains a time-of-check-time-of-use (TOCTOU) vulnerability that allows an untrusted tenant running code on a supervisor node to redirect privileged file operations to arbitrary locations on the host. An attacker could exploit this to escalate privileges and compromise the integrity of the host system.

Technologies: Apache Storm. Vendors: Apache.

Quick answers

Is CVE-2026-82429 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82429 being exploited in the wild.
How severe is CVE-2026-82429?
High severity, with a CVSS score of 7.8, published 14 September 2026.
Which products and versions are affected?
Apache Storm before 3.1.0.
Is there a fix for CVE-2026-82429?
A patch was published on 2026-09-14: Fix available in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82429 attacked?
It is attacked with local access.
Am I affected by CVE-2026-82429?
Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a TOCTOU symlink-attack in the setuid-root worker-launcher binary. The flaw exists in how the launcher walks worker directory trees using FTS (File Tree Traverse) and then performs lchown and chmod operations on each entry using full pathnames while running as root (uid 0). Because the paths are re-resolved at syscall time after FTS has classified them, an unprivileged tenant can replace an intermediate directory component with a symbolic link between classification and the privileged operation, redirecting root-owned operations to arbitrary files. The attack requires code execution on a supervisor node and is repeatable—failed attempts cost nothing since worker crashes trigger re-launches. The fix (version 3.1.0) operates on pre-stat'd file descriptors instead of re-resolving pathnames. The launcher binary must be rebuilt and reinstalled; upgrading Java artifacts alone is insufficient.

Affected products

  • Apache Storm before 3.1.0

Timeline

  • 2026-09-14: disclosed
  • 2026-09-14: patched: Fix available in version 3.1.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.