CVE-2026-124495: Apache When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files
This Apache advisory covers CVE-2026-124495. Related products: Apache Storm.
- CVE-2026-124495
Key facts
- Vendor rating
- Low
- Weakness
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- CISA KEV
- Not listed (catalogue checked )
- Versions named
- Apache Storm 3.0.0 before 3.2.0
- Fixed in
- 3.2.0
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Related products & platforms
Description
When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read.
Users are recommended to upgrade to version 3.2.0, which fixes the issue.
Affected product named by the advisory: Apache Storm.
Text from the source record.
- Apache Storm 3.0.0 before 3.2.0
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-124495
Upgrade to a fixed release named by Apache:
- 3.2.0
Vendor guidance
- Users are recommended to upgrade to version 3.2.0, which fixes the issue.
More Apache Software Foundation advisories
CVE-2026-124496Nov 11, 2026The DRPC HTTP endpoint lets an authenticated client act as another user without applyingCVE-2026-94125Nov 11, 2026Nimbus returns the worker placement of every topology running on a supervisor, includingCVE-2026-82436Nov 9, 2026Apache Storm: Description `DefaultStateSerializer`, used to persist and restore statefulCVE-2026-82427Sep 14, 2026Apache Storm: Description A topology's `topology.blobstore.map` lets the submitter chooseCVE-2026-82428Sep 14, 2026Apache Storm: Description Dependency artifacts uploaded with `storm jar --artifacts`CVE-2026-82429Sep 14, 2026Apache Storm: Description The setuid-root `worker-launcher` binary adjusts ownership
Apache Software Foundation advisories, November 2026All Apache Software Foundation advisories
Get an email when Apache publishes the next one.
See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
