CVE-2026-82429

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82429", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-08-29T10:14:24.656Z", "datePublished": "2026-09-14T14:16:45.617Z", "dateUpdated": "2026-09-14T20:00:03.659Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-14T14:16:45.617Z"}, "title": "Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher", "problemTypes": [{"descriptions": [{"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition", "lang": "en", "cweId": "CWE-367", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Storm Worker Launcher", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.storm:storm-core", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Description\n\nThe setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking\nthe tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an\neffective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the\nentry, and the trees being walked are owned and writable by the untrusted topology user.\n\nA tenant running code on a supervisor node could therefore replace an intermediate directory component with\na symbolic link between classification and the privileged operation, redirecting the root-owned `lchown` or\n`chmod` at an arbitrary file on the host. The operation is repeatable at will, since crashing a worker\nforces a relaunch and blob updates re-run the walk, so a failed attempt costs the attacker nothing.\n\nThis crosses the boundary that `supervisor.run.worker.as.user` and container isolation are intended to\nenforce. It is the same defect class as the Hadoop container-executor issues from which this code derives.\n\nMitigation\n\nUpgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat'd rather than\non pathnames re-resolved at call time.\n\nUsers who cannot upgrade immediately should not run untrusted topology code on supervisors configured with\n`supervisor.run.worker.as.user`, since the launcher is the boundary being crossed. Note that the launcher\nmust be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<b>Description</b><br><br>The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking<br>the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an<br>effective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the<br>entry, and the trees being walked are owned and writable by the untrusted topology user.<br><br>A tenant running code on a supervisor node could therefore replace an intermediate directory component with<br>a symbolic link between classification and the privileged operation, redirecting the root-owned `lchown` or<br>`chmod` at an arbitrary file on the host. The operation is repeatable at will, since crashing a worker<br>forces a relaunch and blob updates re-run the walk, so a failed attempt costs the attacker nothing.<br><br>This crosses the boundary that `supervisor.run.worker.as.user` and container isolation are intended to<br>enforce. It is the same defect class as the Hadoop container-executor issues from which this code derives.<br><br><b>Mitigation</b><br><br>Upgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat'd rather than<br>on pathnames re-resolved at call time.<br><br>Users who cannot upgrade immediately should not run untrusted topology code on supervisors configured with<br>`supervisor.run.worker.as.user`, since the launcher is the boundary being crossed. Note that the launcher<br>must be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient.<br><br><b>Credit</b><br><br>The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.<br>"}]}], "references": [{"url": "https://lists.apache.org/thread/9vjqrt28g0mxg304vw6pw46cx72v4rvq", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The ASF using Claude Agents", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/13/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-14T15:13:44.810Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-14T19:59:35.240189Z", "id": "CVE-2026-82429", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T20:00:03.659Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/13/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-14T15:13:44.810Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-82429", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-14T19:59:35.240189Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T19:59:57.683Z"}}], "cna": {"title": "Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "The ASF using Claude Agents"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Storm Worker Launcher", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.1.0", "versionType": "semver"}], "packageName": "org.apache.storm:storm-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/9vjqrt28g0mxg304vw6pw46cx72v4rvq", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Description\n\nThe setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking\nthe tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an\neffective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the\nentry, and the trees being walked are owned and writable by the untrusted topology user.\n\nA tenant running code on a supervisor node could therefore replace an intermediate directory component with\na symbolic link between classification and the privileged operation, redirecting the root-owned `lchown` or\n`chmod` at an arbitrary file on the host. The operation is repeatable at will, since crashing a worker\nforces a relaunch and blob updates re-run the walk, so a failed attempt costs the attacker nothing.\n\nThis crosses the boundary that `supervisor.run.worker.as.user` and container isolation are intended to\nenforce. It is the same defect class as the Hadoop container-executor issues from which this code derives.\n\nMitigation\n\nUpgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat'd rather than\non pathnames re-resolved at call time.\n\nUsers who cannot upgrade immediately should not run untrusted topology code on supervisors configured with\n`supervisor.run.worker.as.user`, since the launcher is the boundary being crossed. Note that the launcher\nmust be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.", "supportingMedia": [{"type": "text/html", "value": "<b>Description</b><br><br>The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking<br>the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an<br>effective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the<br>entry, and the trees being walked are owned and writable by the untrusted topology user.<br><br>A tenant running code on a supervisor node could therefore replace an intermediate directory component with<br>a symbolic link between classification and the privileged operation, redirecting the root-owned `lchown` or<br>`chmod` at an arbitrary file on the host. The operation is repeatable at will, since crashing a worker<br>forces a relaunch and blob updates re-run the walk, so a failed attempt costs the attacker nothing.<br><br>This crosses the boundary that `supervisor.run.worker.as.user` and container isolation are intended to<br>enforce. It is the same defect class as the Hadoop container-executor issues from which this code derives.<br><br><b>Mitigation</b><br><br>Upgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat'd rather than<br>on pathnames re-resolved at call time.<br><br>Users who cannot upgrade immediately should not run untrusted topology code on supervisors configured with<br>`supervisor.run.worker.as.user`, since the launcher is the boundary being crossed. Note that the launcher<br>must be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient.<br><br><b>Credit</b><br><br>The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-14T14:16:45.617Z"}}}, "cveMetadata": {"cveId": "CVE-2026-82429", "state": "PUBLISHED", "dateUpdated": "2026-09-14T20:00:03.659Z", "dateReserved": "2026-08-29T10:14:24.656Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-09-14T14:16:45.617Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.storm:storm-core", "product": "Apache Storm Worker Launcher", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.1.0", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Description\n\nThe setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking\nthe tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an\neffective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the\nentry, and the trees being walked are owned and writable by the untrusted topology user.\n\nA tenant running code on a supervisor node could therefore replace an intermediate directory component with\na symbolic link between classification and the privileged operation, redirecting the root-owned `lchown` or\n`chmod` at an arbitrary file on the host. The operation is repeatable at will, since crashing a worker\nforces a relaunch and blob updates re-run the walk, so a failed attempt costs the attacker nothing.\n\nThis crosses the boundary that `supervisor.run.worker.as.user` and container isolation are intended to\nenforce. It is the same defect class as the Hadoop container-executor issues from which this code derives.\n\nMitigation\n\nUpgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat'd rather than\non pathnames re-resolved at call time.\n\nUsers who cannot upgrade immediately should not run untrusted topology code on supervisors configured with\n`supervisor.run.worker.as.user`, since the launcher is the boundary being crossed. Note that the launcher\nmust be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."}], "id": "CVE-2026-82429", "lastModified": "2026-09-14T20:58:48.430", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82429", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-14T19:59:35.240189Z", "version": "2.0.3"}}]}, "published": "2026-09-14T15:17:09.807", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/9vjqrt28g0mxg304vw6pw46cx72v4rvq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/13/9"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Apache Storm Worker Launcher", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_storm_worker_launcher", "vendor": "apache_software_foundation"}], "created": "2026-09-15T14:15:05.917935+00:00", "updated": "2026-11-13T12:38:53.905388+00:00", "vendors": ["apache_software_foundation", "apache_software_foundation$PRODUCT$apache_storm_worker_launcher"]}