Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Apache Storm Worker Launcher 3.1.0 Clear all filters
TI-2026-56832 CVE-2026-82429 · GHSA-qchc-32xg-c7w6

Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

Priority LOW 35

Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00127 Published 2026-09-14 Fixed in 3.1.0 CWE-367
TI-2026-56833 CVE-2026-82430 · GHSA-pjcp-2m43-fmv9

Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Priority LOW 35

Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the comman…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00137 Published 2026-09-14 Fixed in 3.1.0 CWE-367