CVE-2026-124495 · Package
NO FIX YET · SEE WHAT TO DO
When Storm workers run as the topology owner, the Logviewer follows links a worker has placed in its own log directory to other files. A user allowed to submit topologies can read other users' worker logs and other files the Logviewer process can read.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only clusters where workers run as the topology owner (run-as-user enabled) are exposed. Clusters with the default worker user setting, or those where only trusted users can submit topologies, face less risk. unknown for anything beyond this.
Not affected if default-config, trusted-submitters-only
Who cares apache-storm, run-as-user, self-hosted
supervisor.run.worker.as.user setting in storm.yaml).storm version; versions before 3.2.0 are affected.3.2.0.When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.