CVE-2026-82437
Deferred Deferred - Pending Action

Logviewer Unauthorized Daemon Log Access Vulnerability

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description
Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer whenever the flag was set, and the daemon log page and download endpoints reached the handler without consulting an authorizer at all. Any user able to pass the configured servlet filter could therefore read `nimbus.log`, `supervisor.log` and the other daemon logs on every reachable node, which contain other tenants' topology names, owners and configuration fragments. The same advisory covers the log listing endpoints, which accepted a user argument and never applied it, so `/listLogs` and `/searchLogs` returned every tenant's topology and worker log file names regardless of the caller. That part is metadata only. There was no configuration that closed either behaviour. Mitigation Upgrade to 3.1.0, where the daemon log paths evaluate the same configured user and group lists that the worker log paths already used, and the listing endpoints filter by the requesting user. Users who cannot upgrade immediately should place the Logviewer behind a reverse proxy that restricts the daemon log endpoints, and should treat daemon log content as readable by any filter-authenticated user. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-82437
EUVD
EUVD-2026-77516

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache logviewer 3.1.0
apache storm_logviewer to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82437 is an improper access control flaw in Apache Storm Logviewer versions before 3.1.0. The vulnerability allows unauthorized users to read sensitive daemon logs like nimbus.log and supervisor.log. The issue occurs because the Logviewer fails to enforce user and group access controls for daemon logs, treating them differently from worker logs. Additionally, log listing endpoints like /listLogs and /searchLogs expose metadata for all tenants' logs without filtering by the requesting user.

Detection Guidance

Check Apache Storm Logviewer version with: curl -s http://<logviewer-host>:<port>/version | grep version. If version is 3.0.0 or earlier, the system is vulnerable. Inspect logs for unauthorized access attempts to daemon log endpoints like /logs/daemon or /downloadDaemonLog.

Impact Analysis

This vulnerability allows any authenticated user to read sensitive log files containing other tenants' topology names, owners, and configuration fragments. Attackers could access confidential information like system configurations and user data. The metadata exposure via listing endpoints reveals all tenants' log file names, potentially aiding further attacks.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive log data. Daemon logs contain other tenants' topology names, owners, and configuration fragments, which may include personally identifiable information (PII) or protected health information (PHI). Unauthorized exposure of such data violates confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade to Apache Storm Logviewer version 3.1.0 or later. If immediate upgrade is not possible, restrict access to daemon log endpoints using a reverse proxy that enforces authentication and authorization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82437. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart