CVE-2026-82429

Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the entry, and the trees being walked are owned and writable by the untrusted topology user. A tenant running code on a supervisor node could therefore replace an intermediate directory component with a symbolic link between classification and the privileged operation, redirecting the root-owned `lchown` or `chmod` at an arbitrary file on the host. The operation is repeatable at will, since crashing a worker forces a relaunch and blob updates re-run the walk, so a failed attempt costs the attacker nothing. This crosses the boundary that `supervisor.run.worker.as.user` and container isolation are intended to enforce. It is the same defect class as the Hadoop container-executor issues from which this code derives. Mitigation Upgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat'd rather than on pathnames re-resolved at call time. Users who cannot upgrade immediately should not run untrusted topology code on supervisors configured with `supervisor.run.worker.as.user`, since the launcher is the boundary being crossed. Note that the launcher must be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

• CWE-367

• https://lists.apache.org/thread/9vjqrt28g0mxg304vw6pw46cx72v4rvq
• https://www.openwall.com/lists/oss-security/2026/09/13/9

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82422A security flaw has been discovered in itsourcecode Sales an…6.3
• CVE-2026-82423A vulnerability has been found in macrozheng mall up to 1.0.…5.4
• CVE-2026-82424A weakness has been identified in PHPGurukul Student Informa…6.3
• CVE-2026-82426Description Nimbus accepted the `uploadedJarLocation` argum…6.5
• CVE-2026-82427Description A topology's `topology.blobstore.map` lets the …7.8
• CVE-2026-82428Description Dependency artifacts uploaded with `storm jar -…8.8
• CVE-2026-8243A vulnerability was determined in Industrial Application Sof…6.9
• CVE-2026-82430Description When launching a Docker or OCI worker, the setu…7.8
• CVE-2026-82431Description `SimpleACLAuthorizer` evaluated the user-level …9.8
• CVE-2026-82432Description Nimbus validated `topology.blobstore.map` again…8.1
• CVE-2026-82433Description `getNimbusConf` returned the complete daemon co…6.5
• CVE-2026-82434Description When ZooKeeper authentication is configured, St…6.5