CVE-2026-124495— Apache Storm: Logviewer follows worker symlinks across topology ACLs
Quick assessment
Affected
Apache Software Foundation Apache Storm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当 Worker 以拓扑所有者身份运行时，Logviewer 会将 Worker 放置在其自身日志目录中的文件，以链接形式指向其他文件。任何被允许提交拓扑的用户均可读取其他用户拓扑的 Worker 日志，以及 Logviewer 进程有权访问的其他文件。建议用户升级至 3.2.0 版本，该版本已修复此问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-124495
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Storm: Logviewer follows worker symlinks across topology ACLs
Source: CVE Program / CVE List V5
Vulnerability Description
When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Storm | 3.0.0 ~ 3.2.0 | - |
|
II. Public POCs for CVE-2026-124495
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-124495
请登录查看更多情报信息。
Other References for CVE-2026-124495 (1)
-
https://lists.apache.org/thread/q4xbld4n4v14t8d74vb342skx8d0mzz8 vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-11-11 · 24 CVEs total
| CVE-2026-118411 | 8.8 HIGH | Apache Roller: Cross-site request forgery through GET requests to administrative actions |
| CVE-2026-105153 | 7.7 HIGH | Apache Roller: XML external entity processing in AtomPub entry parsing |
| CVE-2026-105154 | 6.1 MEDIUM | Apache Roller: Cross-site request forgery in Planet administration lets an attacker make t |
| CVE-2026-118414 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting through the weblog description |
| CVE-2026-118413 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting through imported blogroll links |
| CVE-2026-118409 | 5.3 MEDIUM | Apache Roller: Commenter email addresses recoverable through public search |
| CVE-2026-118405 | 4.3 MEDIUM | Apache Roller: Exposure of other users' email addresses through the user search |
| CVE-2026-105152 | 4.3 MEDIUM | Apache Roller: Weblog template access to wrapped objects exposes another user's password h |
| CVE-2026-118410 | 3.7 LOW | Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish |
| CVE-2026-118408 | 3.1 LOW | Apache Roller: Unpublished entries of other weblogs readable through preview |
| CVE-2026-118412 | 3.1 LOW | Apache Roller: Disabled accounts can sign in through OpenID |
| CVE-2026-111824 | Apache Roller: Stored cross-site scripting through custom-theme resource URLs | |
| CVE-2026-122096 | Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted ske | |
| CVE-2026-94125 | Apache Storm: Supervisor page discloses worker placement of other users' topologies | |
| CVE-2026-126627 | Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local | |
| CVE-2026-111792 | Apache XML Graphics Batik: Denial of Service via SVG Element Reference Resolution | |
| CVE-2026-90993 | Apache XML Graphics Batik: Harden validation in SAXDocumentFactory | |
| CVE-2026-124496 | Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer | |
| CVE-2026-108338 | Apache Roller: Stored cross-site scripting through AtomPub entry tags | |
| CVE-2026-49236 | Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource sam |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Storm
-
CVE-2026-124496
Apache Storm: DRPC HTTP doAsUser bypasses the impersonation -
CVE-2026-94125
Apache Storm: Supervisor page discloses worker placement of -
CVE-2023-43123
Apache Storm: Local Information Disclosure Vulnerability in -
CVE-2021-40865
Unsafe Pre-Authentication Deserialization In Workers -
CVE-2021-38294
Shell Command Injection Vulnerability in Nimbus Thrift Serve
Same vendor: Apache Software Foundation
-
CVE-2026-49236
Apache XML Graphics Batik: SVG color-profile xml:base bypass -
CVE-2026-40853
Apache XML Graphics Batik: Cross-Site Scripting via Unencode -
CVE-2026-123374
Apache Roller: Deserialization of untrusted data in weblog u -
CVE-2026-122300
Apache Roller: Limited weblog members can remove or change p -
CVE-2026-118414
Apache Roller: Stored cross-site scripting through the weblo
Same weakness: CWE-59
-
CVE-2026-124745
Busybox: tar deferred hardlink target resolved through a def -
CVE-2026-124744
Busybox: cpio hardlink target not sanitized under feature_pa -
CVE-2026-126612
Improper Link Resolution Before File Access ('Link Following -
CVE-2026-122182
Windows Maps Elevation of Privilege Vulnerability -
CVE-2026-122177
Windows iSCSI Elevation of Privilege Vulnerability