CVE-2026-82437 Overview
CVE-2026-82437 is a missing authorization vulnerability [CWE-862] in the Apache Storm Logviewer component. The Logviewer exposes logs.users and logs.groups settings that operators use to restrict who can read log content. Those settings were not applied to daemon logs. The access decision combined a "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer whenever the flag was set. The daemon log page and download endpoints reached the handler without consulting an authorizer at all. Any user able to pass the configured servlet filter could read nimbus.log, supervisor.log and other daemon logs, exposing other tenants' topology names, owners, and configuration fragments.
Critical Impact
Filter-authenticated users can read cross-tenant daemon log content and enumerate every tenant's topology and worker log file names through /listLogs and /searchLogs.
Affected Products
- Apache Storm Logviewer versions prior to 3.1.0
- Apache Storm daemon log endpoints (nimbus.log, supervisor.log)
- Apache Storm log listing endpoints (/listLogs, /searchLogs)
Discovery Timeline
- 2026-09-14 - CVE-2026-82437 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-82437
Vulnerability Analysis
The Apache Storm Logviewer provides web-based access to worker and daemon logs across a Storm cluster. Operators configure logs.users and logs.groups to restrict access to log content. Worker log paths correctly evaluated these configured user and group lists. Daemon log paths did not.
The access decision for daemon logs combined the daemon log flag with the authorizer result incorrectly. When the flag indicated a daemon log, the authorizer's answer was discarded. The daemon log page and download endpoints also bypassed the authorizer entirely and reached the handler without any check.
A second flaw affected the log listing endpoints. The /listLogs and /searchLogs endpoints accepted a user argument but never applied it during filtering. Callers received every tenant's topology and worker log file names regardless of identity. That exposure is metadata only, but it enables reconnaissance across tenant boundaries.
No configuration option closed either behavior. Operators had no supported way to enforce the documented access controls on daemon logs before upgrading.
Root Cause
The root cause is missing authorization [CWE-862] on the daemon log page, daemon log download, and log listing endpoints of the Logviewer. The authorizer result was discarded for daemon logs, and listing endpoints ignored the user argument used for filtering.
Attack Vector
An authenticated user who passes the configured servlet filter sends HTTP requests to the Logviewer daemon log endpoints on any reachable node. The handler returns nimbus.log, supervisor.log, or other daemon log content without consulting logs.users or logs.groups. The same user queries /listLogs or /searchLogs to enumerate every tenant's topology and worker log file names.
No verified public exploit code is available. See the Apache Security Discussion Thread and the OpenWall OSS Security Update for advisory detail.
Detection Methods for CVE-2026-82437
Indicators of Compromise
- HTTP requests from filter-authenticated users to Logviewer daemon log paths returning nimbus.log or supervisor.log content that the user's logs.users or logs.groups entry should not permit.
- Access log entries showing /listLogs or /searchLogs responses that include topology or worker log file names owned by tenants other than the requester.
- Unexpected download volume from Logviewer daemon log endpoints across multiple Storm nodes.
Detection Strategies
- Compare Logviewer access logs against the configured logs.users and logs.groups lists to identify daemon log reads by users outside the allow list.
- Alert when a single authenticated principal enumerates log listings across multiple tenants within a short window.
- Correlate Logviewer request patterns with topology ownership metadata to surface cross-tenant metadata access.
Monitoring Recommendations
- Forward Logviewer HTTP access logs and daemon log download events to a centralized SIEM for cross-node correlation.
- Baseline normal per-user request volume against /logs, /download, /listLogs, and /searchLogs endpoints and alert on deviations.
- Monitor reverse proxy access logs for direct requests to daemon log endpoints originating from users who should not have daemon-level access.
How to Mitigate CVE-2026-82437
Immediate Actions Required
- Upgrade Apache Storm to version 3.1.0, where daemon log paths evaluate the same logs.users and logs.groups lists as worker log paths, and listing endpoints filter by the requesting user.
- Treat all pre-3.1.0 daemon log content as readable by any filter-authenticated user until the upgrade completes.
- Rotate any secrets, tokens, or credentials that may have appeared in nimbus.log, supervisor.log, or other daemon logs.
Patch Information
Upgrade to Apache Storm 3.1.0. The fix aligns daemon log path authorization with the existing worker log path checks and adds a user filter to the log listing endpoints. Refer to the Apache Security Discussion Thread for the official advisory.
Workarounds
- Place the Logviewer behind a reverse proxy that restricts access to the daemon log page, daemon log download, /listLogs, and /searchLogs endpoints to authorized operators only.
- Assume daemon log content is readable by every filter-authenticated user and remove sensitive material from those logs where possible.
- Restrict network reachability of the Logviewer port to trusted operator networks until the upgrade to 3.1.0 is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
