---
id: CVE-2026-82429
title: >-
  Description


  The setuid-root `worker-launcher` binary adjusts ownership and permissions of
  worker directories by walking

  the tree with FTS and calling `lchown` and `chmod` on each entry's full
  pathname while running with an

  effective uid…
summary: >-
  Description


  The setuid-root `worker-launcher` binary adjusts ownership and permissions of
  worker directories by walking

  the tree with FTS and calling `lchown` and `chmod` on each entry's full
  pathname while running with an

  effective uid…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-367
vendor: Apache Software Foundation
product: 'org.apache.storm:storm-core'
affected:
  - 'org.apache.storm:storm-core >= 3.0.0 < 3.1.0'
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:58:48.430'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82429'
references:
  - url: 'https://lists.apache.org/thread/9vjqrt28g0mxg304vw6pw46cx72v4rvq'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/13/9'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T19:59:35.240189Z'
ingestedAt: '2026-09-14T15:23:07.424Z'
epss: 0.00127
epssPercentile: 0.02027
---

## Overview

Description

The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking
the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an
effective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the
entry, and the trees being walked are owned and writable by the untrusted topology user.

A tenant running code on a supervisor node could therefore replace an intermediate directory component with
a symbolic link between classification and the privileged operation, redirecting the root-owned `lchown` or
`chmod` at an arbitrary file on the host. The operation is repeatable at will, since crashing a worker
forces a relaunch and blob updates re-run the walk, so a failed attempt costs the attacker nothing.

This crosses the boundary that `supervisor.run.worker.as.user` and container isolation are intended to
enforce. It is the same defect class as the Hadoop container-executor issues from which this code derives.

Mitigation

Upgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat'd rather than
on pathnames re-resolved at call time.

Users who cannot upgrade immediately should not run untrusted topology code on supervisors configured with
`supervisor.run.worker.as.user`, since the launcher is the boundary being crossed. Note that the launcher
must be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient.

Credit

The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.