CVE-2026-82429: Apache Storm Privilege Escalation Vulnerability

CVE-2026-82429 Overview

CVE-2026-82429 is a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-367] in the Apache Storm worker-launcher setuid-root binary. The launcher walks worker directory trees using FTS and calls lchown and chmod on each entry's full pathname while running with an effective UID of 0. Because both syscalls re-resolve the path after FTS classification, a tenant on a supervisor node can swap an intermediate directory component with a symbolic link and redirect the privileged operation to an arbitrary host file. The flaw defeats the isolation boundary that supervisor.run.worker.as.user and container isolation are intended to enforce.

Critical Impact
A local topology user on a Storm supervisor node can escalate to root by redirecting lchown or chmod operations to arbitrary files on the host.

Affected Products

Apache Storm supervisor nodes running worker-launcher prior to version 3.1.0
Deployments configured with supervisor.run.worker.as.user
Multi-tenant Storm clusters where untrusted topology code executes on shared supervisors

Discovery Timeline

2026-09-14 - CVE-2026-82429 published to NVD
2026-09-14 - Last updated in NVD database
Credit: The Apache Software Foundation, using Claude agents to study open-source project security, validated and reported by Apache Storm

Technical Details for CVE-2026-82429

Vulnerability Analysis

The worker-launcher binary is installed setuid-root so it can adjust ownership and permissions on worker directories owned by the untrusted topology user. It walks the tree with FTS, classifies each entry, then calls lchown and chmod on the entry's full pathname. The kernel re-resolves that pathname at syscall time, opening a window between classification and the privileged operation.

Because the tree being walked is writable by the tenant, an attacker can replace an intermediate directory component with a symbolic link during that window. The root-owned lchown or chmod then follows the attacker-controlled path and mutates an arbitrary file on the host. Failed attempts cost nothing: crashing a worker forces a relaunch, and blob updates re-run the walk, so the attacker can retry indefinitely.

The defect class matches the historical Hadoop container-executor issues from which this Storm code derives.

Root Cause

The root cause is operating on pathnames rather than file descriptors across a trust boundary. FTS classification and the subsequent lchown or chmod calls are not atomic. Any component of the resolved path can change between the check and the use, and the tenant owns the directory tree being traversed.

Attack Vector

Attack requires local code execution on a supervisor node as a topology user. The attacker races the privileged walk by replacing a directory component with a symlink pointing at a sensitive host file. Successful redirection of chown to a root-owned file, or chmod to widen permissions, yields privilege escalation to root. Consult the Apache Thread Discussion and OpenWall OSS Security Update for full technical context.

Detection Methods for CVE-2026-82429

Indicators of Compromise

Unexpected ownership or permission changes on host files outside worker directories, such as entries under /etc, /root, or setuid binaries.
Repeated worker crashes followed by immediate relaunches originating from the same topology user.
Symbolic links present within worker directory trees pointing outside the topology sandbox.
Frequent blob update cycles correlated with filesystem metadata changes on sensitive paths.

Detection Strategies

Audit lchown and chmod syscalls invoked by the worker-launcher process using Linux audit rules or eBPF probes, alerting on target paths outside the expected worker root.
Monitor for symlink or rename syscalls issued by topology-user processes against directory components used by the launcher.
Baseline the expected file ownership map on supervisor hosts and alert on drift.

Monitoring Recommendations

Enable process and syscall telemetry on all Storm supervisor nodes and forward it to a centralized analytics platform for correlation.
Track worker relaunch frequency per topology user and alert on abnormal churn.
Review file integrity monitoring output for changes to root-owned files coincident with worker-launcher execution.

How to Mitigate CVE-2026-82429

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0 or later, where the privileged walk operates on file descriptors already stat'd rather than re-resolved pathnames.
Rebuild and reinstall the worker-launcher binary after upgrading; replacing the Java artifacts alone is not sufficient.
Inventory supervisor nodes configured with supervisor.run.worker.as.user and prioritize them for patching.

Patch Information

Apache Storm 3.1.0 fixes the vulnerability by having the privileged walk operate on file descriptors it has already stat'd, eliminating the pathname re-resolution window. The native worker-launcher binary must be rebuilt and reinstalled as part of the upgrade. Refer to the Apache Thread Discussion for release details.

Workarounds

Do not run untrusted topology code on supervisors configured with supervisor.run.worker.as.user, since the launcher is the boundary being crossed.
Restrict topology submission to trusted users until the patched launcher is deployed.
Isolate supervisor nodes running vulnerable launchers on segmented networks with strict egress controls.

bash

# Verify installed worker-launcher version and ownership after upgrade
strings $(which worker-launcher) | grep -i version
stat $(which worker-launcher)
# Confirm supervisor.run.worker.as.user setting
grep supervisor.run.worker.as.user $STORM_HOME/conf/storm.yaml