CVE-2026-82437: Apache Storm Logviewer access control bypass in daemon logs

CVE-2026-82437 · Severity: medium · CVSS 4.3 · Published 2026-09-14

Apache Storm's Logviewer component manages access to system and application logs across distributed nodes. A vulnerability in the daemon log access controls allows any authenticated user to read sensitive daemon logs (nimbus.log, supervisor.log) and log file listings without proper authorization checks, potentially exposing other tenants' topology configurations, ownership details, and operational metadata.

Technologies: Apache Storm. Vendors: Apache.

Quick answers

Is CVE-2026-82437 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82437 being exploited in the wild.
How severe is CVE-2026-82437?
Medium severity, with a CVSS score of 4.3, published 14 September 2026.
Which products and versions are affected?
Apache Storm before 3.1.0.
Is there a fix for CVE-2026-82437?
A patch was published on 2026-09-14: Fixed in Apache Storm 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82437 attacked?
It is attacked over the network.
Am I affected by CVE-2026-82437?
Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass affecting Apache Storm's Logviewer daemon log endpoints. The root cause is faulty logic in the access decision handler: when processing daemon logs, the authorization result was discarded if the "is daemon log" flag was set, and certain endpoints (daemon log page and download) bypassed authorization checks entirely. An attacker with network access to a Logviewer instance and ability to pass the servlet filter can read /nimbus.log, /supervisor.log, and other daemon logs on all reachable nodes. Additionally, the /listLogs and /searchLogs endpoints accept but ignore the user parameter, exposing log file listings from all tenants. The vulnerability was fixed in version 3.1.0 by applying consistent user/group authorization checks to daemon log paths and filtering listing endpoints by requesting user.

Affected products

  • Apache Storm before 3.1.0

Timeline

  • 2026-09-14: disclosed
  • 2026-09-14: patched: Fixed in Apache Storm 3.1.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.