---
id: "CVE-2026-124495"
page: "https://infrastack.ai/live/CVE-2026-124495"
kind: "vulnerability"
aliases: ["CVE-2026-124495"]
title: "Apache Storm: Logviewer serves symlinked files, exposing other users' worker logs"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-storm", "package", "run-as-user", "self-hosted"]
not_affected_if: ["default-config", "trusted-submitters-only"]
published_at: "2026-11-11T13:17:19+00:00"
first_seen_at: "2026-11-11T13:27:12+00:00"
updated_at: "2026-11-11T13:30:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124495", "first_seen_at": "2026-11-11T13:27:12+00:00"}]
exploit_sources: []
---

# Apache Storm: Logviewer serves symlinked files, exposing other users' worker logs

Link for people: https://infrastack.ai/live/CVE-2026-124495 (this .md is for agents)

When Storm workers run as the topology owner, the Logviewer follows links a worker has placed in its own log directory to other files. A user allowed to submit topologies can read other users' worker logs and other files the Logviewer process can read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether workers run as the topology owner (the `supervisor.run.worker.as.user` setting in `storm.yaml`).
- Check the installed Apache Storm version with `storm version`; versions before `3.2.0` are affected.

## Fix

- Apache Storm: upgrade to `3.2.0`.

## Timeline

- 2026-11-11T13:27:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124495

## From the sources

When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_