CVE-2026-82430
Deferred Deferred - Pending Action

Privilege Escalation in Apache Storm Worker Launcher

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description
Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without re-verifying its owner, so between the ownership change and the read the tenant can replace its contents. For the Docker path the parsed command is executed with real uid 0, and the command sanitiser is not a privilege boundary: it admits `-v` with an arbitrary source, `--device`, `--cap-add`, `--security-opt`, `--user` and `--net`, and copies positional arguments through verbatim. A rewritten file therefore yields an attacker-authored, root-equivalent container invocation with the host filesystem available. For the OCI path the same rewrite window applies, and mount validation is structural only, with no source or destination allow-list, so arbitrary host paths can be bind-mounted read-write into the container. The `username` field of the command file is likewise attacker-settable and is checked only against non-root and minimum-uid rules, permitting execution as another tenant's uid. Mitigation Upgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open, and where mount sources and destinations are constrained by configuration. Users who cannot upgrade immediately should disable Docker and OCI worker isolation, or restrict topology submission on affected supervisors to trusted principals. Note that the launcher must be rebuilt and reinstalled after upgrading. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-82430
EUVD
EUVD-2026-77527

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache storm 3.1.0
apache storm_worker_launcher to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a race condition in Docker or OCI worker setups where a worker-launcher changes directory ownership to an untrusted user before validating a command file. An attacker can replace the file between ownership change and read, leading to root-equivalent container execution with host filesystem access or arbitrary bind mounts.

Detection Guidance

This vulnerability involves a race condition in Docker or OCI worker setups where an attacker can replace a command file after ownership is changed but before it is read. Detection requires checking for suspicious activity in worker directories or unusual container invocations. Look for commands with root-equivalent privileges or unexpected mount operations. Review logs for topology submissions from untrusted sources.

Impact Analysis

An attacker could gain root access on the host system, execute arbitrary containers with host filesystem access, or bind-mount sensitive host paths into containers. This could lead to data theft, system compromise, or lateral movement in multi-tenant environments.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data (GDPR Article 32, HIPAA Security Rule). It undermines isolation controls required for regulated environments, potentially leading to data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade to Apache Storm 3.1.0 to address the issue. If immediate upgrade is not possible, disable Docker and OCI worker isolation or restrict topology submissions to trusted principals. Rebuild and reinstall the launcher after upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart