{"id":"CVE-2026-124495","kind":"vulnerability","aliases":["CVE-2026-124495"],"related":[],"title":"Apache Storm: Logviewer serves symlinked files, exposing other users' worker logs","description":"When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue.","summary":"When Storm workers run as the topology owner, the Logviewer follows links a worker has placed in its own log directory to other files. A user allowed to submit topologies can read other users' worker logs and other files the Logviewer process can read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-storm","package","run-as-user","self-hosted"],"not_affected_if":["default-config","trusted-submitters-only"],"how_to_check":"- Check whether workers run as the topology owner (the `supervisor.run.worker.as.user` setting in `storm.yaml`).\n- Check the installed Apache Storm version with `storm version`; versions before `3.2.0` are affected.","fix":"- Apache Storm: upgrade to `3.2.0`.","status":"open","published_at":"2026-11-11T13:17:19+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:30:01+00:00","updated_at":"2026-11-11T13:30:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T13:30:01Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Storm: upgrade to `3.2.0`.","reach":"network","title":"Apache Storm: Logviewer serves symlinked files, exposing other users' worker logs","impact":"medium","summary":"When Storm workers run as the topology owner, the Logviewer follows links a worker has placed in its own log directory to other files. A user allowed to submit topologies can read other users' worker logs and other files the Logviewer process can read.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-storm","self-hosted","run-as-user"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Other users' worker logs and files readable by the Logviewer process","analyst_note":"","how_to_check":"- Check whether workers run as the topology owner (the `supervisor.run.worker.as.user` setting in `storm.yaml`).\n- Check the installed Apache Storm version with `storm version`; versions before `3.2.0` are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","trusted-submitters-only"],"who_is_affected":"Only clusters where workers run as the topology owner (run-as-user enabled) are exposed. Clusters with the default worker user setting, or those where only trusted users can submit topologies, face less risk. unknown for anything beyond this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4550,"output_tokens":510,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124495':14A,17A '-2026':13A,16A '3.2.0':131C 'allow':55B,103C 'apach':1A,19B 'apache-storm':18B 'cve':12A,15A 'directori':49B,93C 'expos':7A 'file':6A,52B,67B,83C,98C,118C 'fix':133C 'follow':39B 'host':28B 'issu':135C 'link':40B,95C 'log':11A,48B,64B,92C,111C 'logview':3A,38B,69B,81C,120C 'owner':36B,79C 'packag':21B 'place':44B,88C 'process':70B,121C 'read':60B,72B,108C,123C 'recommend':126C 'run':23B,32B,75C 'run-as-us':22B 'self':27B 'self-host':26B 'serv':4A,82C 'storm':2A,20B,30B 'submit':57B,105C 'symlink':5A 'topolog':35B,58B,78C,106C,115C 'upgrad':128C 'user':9A,25B,54B,62B,100C,114C,124C 'version':130C 'worker':10A,31B,42B,63B,74C,86C,110C","nicknames":[],"mitigations":[],"who_affected":"Only clusters where workers run as the topology owner (run-as-user enabled) are exposed. Clusters with the default worker user setting, or those where only trusted users can submit topologies, face less risk. unknown for anything beyond this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachestorm","package","runasuser","selfhosted","unknown"],"campaign_type":null,"search_a":"'-124495':14A,17A '-2026':13A,16A 'apach':1A 'cve':12A,15A 'expos':7A 'file':6A 'log':11A 'logview':3A 'serv':4A 'storm':2A 'symlink':5A 'user':9A 'worker':10A","search_b":"'allow':55B 'apach':19B 'apache-storm':18B 'directori':49B 'file':52B,67B 'follow':39B 'host':28B 'link':40B 'log':48B,64B 'logview':38B,69B 'owner':36B 'packag':21B 'place':44B 'process':70B 'read':60B,72B 'run':23B,32B 'run-as-us':22B 'self':27B 'self-host':26B 'storm':20B,30B 'submit':57B 'topolog':35B,58B 'user':25B,54B,62B 'worker':31B,42B,63B","search_c":"'3.2.0':131C 'allow':103C 'directori':93C 'file':83C,98C,118C 'fix':133C 'issu':135C 'link':95C 'log':92C,111C 'logview':81C,120C 'owner':79C 'place':88C 'process':121C 'read':108C,123C 'recommend':126C 'run':75C 'serv':82C 'submit':105C 'topolog':78C,106C,115C 'upgrad':128C 'user':100C,114C,124C 'version':130C 'worker':74C,86C,110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124495","severity":null,"published_at":"2026-11-11T13:17:19+00:00","modified_at":"2026-11-11T13:17:19+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}