High [CVE-2026-82429] Apache Storm: Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an effective uid of 0

The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an

effective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the

entry, and the trees being walked are owned and writable by the untrusted topology user.

A tenant running code on a supervisor node could therefore replace an intermediate directory component with a symbolic link between classification and the privileged operation, redirecting the root-owned `lchown` or

`chmod` at an arbitrary file on the host. The operation is repeatable at will, since crashing a worker

forces a relaunch and blob updates re-run the walk, so a failed attempt costs the attacker nothing.

This crosses the boundary that `supervisor.run.worker.as.user` and container isolation are intended to enforce.

It is the same defect class as the Hadoop container-executor issues from which this code derives.

Affected product named by the advisory: Apache Storm.