CVE-2026-82430: Docker/OCI Worker Privilege Escalation

CVE-2026-82430 Overview

CVE-2026-82430 is a time-of-check-to-time-of-use ([CWE-367]) flaw in the Apache Storm setuid-root worker-launcher binary. When launching a Docker or Open Container Initiative (OCI) worker, the launcher first changes ownership of the worker directory to the untrusted topology user, then reads the supervisor-authored command file from that same directory. A tenant can replace the command file contents during that window and coerce the launcher into executing an attacker-authored, root-equivalent container invocation.

Critical Impact
A local tenant with topology submission rights can execute code as root on the host, bind-mount arbitrary host paths read-write into a container, and run workloads as another tenant's uid.

Affected Products

Apache Storm supervisors with Docker worker isolation enabled
Apache Storm supervisors with OCI worker isolation enabled
Storm releases prior to 3.1.0

Discovery Timeline

2026-09-14 - CVE-2026-82430 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-82430

Vulnerability Analysis

The worker-launcher is a setuid-root helper that stages worker directories for Docker and OCI topologies. It performs a chown on the entire worker directory to the topology user before parsing the command file that the supervisor wrote there. The command file is opened without O_NOFOLLOW and without re-verifying its owner after opening. Between the ownership change and the read, the tenant owns the directory and can replace the file contents or swap it for a symlink.

For the Docker path, the parsed command runs with real uid 0. The command sanitiser is not a privilege boundary. It admits -v with arbitrary source paths, --device, --cap-add, --security-opt, --user, and --net, and passes positional arguments through verbatim. An attacker-authored invocation can therefore mount the host filesystem, grant capabilities, and disable security profiles.

For the OCI path, mount validation is structural only. There is no allow-list on mount sources or destinations, so arbitrary host paths can be bind-mounted read-write into the container. The username field of the rewritten command file is also attacker-controlled and is checked only against non-root and minimum-uid rules, permitting execution under another tenant's uid.

Root Cause

The launcher inverts the correct ordering: it hands directory ownership to an untrusted principal before validating the file it must trust. Combined with the missing O_NOFOLLOW, missing post-open owner re-check, and a permissive command sanitiser, the ownership handover creates an exploitable race.

Attack Vector

The attacker submits a topology to an affected supervisor. Once the launcher hands ownership of the worker directory to the tenant, the tenant overwrites the command file with attacker-chosen Docker or OCI arguments. The launcher then re-reads the file and executes the rewritten command with root privileges.

No verified public exploit code is available. Refer to the Apache Security Mailing List post and the OpenWall OSS Security update for authoritative technical details.

Detection Methods for CVE-2026-82430

Indicators of Compromise

Container invocations from worker-launcher containing -v /:/, -v /etc, -v /root, or other host-sensitive bind mounts not present in supervisor-authored topologies.
Container arguments including --cap-add, --security-opt seccomp=unconfined, --device, or --net=host when the topology configuration does not authorize them.
Worker command files replaced with symlinks or containing owner uids that do not match the topology's supervisor-written baseline.

Detection Strategies

Audit execve events for the worker-launcher process and its child docker, runc, or crun invocations, comparing arguments against a known-good supervisor template.
Monitor filesystem events on Storm worker directories for rapid rewrite or symlink-swap patterns immediately following chown operations by the launcher.
Alert on any container spawned by Storm running with real uid 0 on the host or with host root path bind mounts.

Monitoring Recommendations

Enable Linux audit rules for open, openat, symlink, and rename syscalls scoped to Storm supervisor working directories.
Forward container runtime logs and host process telemetry into a centralized data lake for cross-correlation of launcher activity with tenant topology submissions.
Track worker-launcher binary integrity and reinstallation events, since the launcher must be rebuilt and reinstalled after upgrading.

How to Mitigate CVE-2026-82430

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0 or later, which validates the command file before the ownership change and re-verifies it on open.
Rebuild and reinstall the worker-launcher binary after upgrading; a package upgrade alone does not replace the setuid helper.
Restrict topology submission on affected supervisors to trusted principals until patching is complete.

Patch Information

Upgrade to Apache Storm 3.1.0. The fix validates the command file prior to the ownership handover, re-verifies the file on open, and constrains mount sources and destinations through configuration. The launcher must be rebuilt and reinstalled for the fix to take effect.

Workarounds

Disable Docker worker isolation on affected supervisors until the upgrade is applied.
Disable OCI worker isolation on affected supervisors until the upgrade is applied.
Limit topology submission privileges to a small set of vetted, trusted operators.

bash

# Configuration example: disable Docker and OCI worker isolation in storm.yaml
storm.resource.isolation.plugin.enable: false
storm.resource.isolation.plugin: ""
# Remove or comment out Docker/OCI worker manager entries
# storm.container.manager: "org.apache.storm.container.docker.DockerManager"
# storm.container.manager: "org.apache.storm.container.oci.OciContainerManager"