Vulnerability-Lookup

CVE-2026-82430 (GCVE-0-2026-82430)

Vulnerability from cvelistv5 – Published: 2026-09-14 14:15 – Updated: 2026-09-14 20:00

Title

Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Summary

Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without re-verifying its owner, so between the ownership change and the read the tenant can replace its contents. For the Docker path the parsed command is executed with real uid 0, and the command sanitiser is not a privilege boundary: it admits `-v` with an arbitrary source, `--device`, `--cap-add`, `--security-opt`, `--user` and `--net`, and copies positional arguments through verbatim. A rewritten file therefore yields an attacker-authored, root-equivalent container invocation with the host filesystem available. For the OCI path the same rewrite window applies, and mount validation is structural only, with no source or destination allow-list, so arbitrary host paths can be bind-mounted read-write into the container. The `username` field of the command file is likewise attacker-settable and is checked only against non-root and minimum-uid rules, permitting execution as another tenant's uid. Mitigation Upgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open, and where mount sources and destinations are constrained by configuration. Users who cannot upgrade immediately should disable Docker and OCI worker isolation, or restrict topology submission on affected supervisors to trusted principals. Note that the launcher must be rebuilt and reinstalled after upgrading. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 20:00 UTC

CWE

CWE-367 - Time-of-check time-of-use (TOCTOU) race condition

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/8d5pkn486p8vrz5kl…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache Storm Worker Launcher	Affected: 3.0.0 , < 3.1.0 (semver)	guessed

Credits

The ASF using Claude Agents

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-14T15:13:47.599Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/13/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-82430",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T20:00:33.467479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T20:00:53.152Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.storm:storm-core",
          "product": "Apache Storm Worker Launcher",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The ASF using Claude Agents"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003eDescription\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eWhen launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the\u003cbr\u003eentire worker directory to the untrusted topology user, and only afterwards reads and acts on the command\u003cbr\u003efile that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without\u003cbr\u003ere-verifying its owner, so between the ownership change and the read the tenant can replace its contents.\u003cbr\u003e\u003cbr\u003eFor the Docker path the parsed command is executed with real uid 0, and the command sanitiser is not a\u003cbr\u003eprivilege boundary: it admits `-v` with an arbitrary source, `--device`, `--cap-add`, `--security-opt`,\u003cbr\u003e`--user` and `--net`, and copies positional arguments through verbatim. A rewritten file therefore yields an\u003cbr\u003eattacker-authored, root-equivalent container invocation with the host filesystem available.\u003cbr\u003e\u003cbr\u003eFor the OCI path the same rewrite window applies, and mount validation is structural only, with no\u003cbr\u003esource or destination allow-list, so arbitrary host paths can be bind-mounted read-write into the\u003cbr\u003econtainer. The `username` field of the command file is likewise attacker-settable and is checked only\u003cbr\u003eagainst non-root and minimum-uid rules, permitting execution as another tenant\u0027s uid.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eMitigation\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eUpgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open,\u003cbr\u003eand where mount sources and destinations are constrained by configuration.\u003cbr\u003e\u003cbr\u003eUsers who cannot upgrade immediately should disable Docker and OCI worker isolation, or restrict topology\u003cbr\u003esubmission on affected supervisors to trusted principals. Note that the launcher must be rebuilt and\u003cbr\u003ereinstalled after upgrading.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eCredit\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."
            }
          ],
          "value": "Description\n\nWhen launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the\nentire worker directory to the untrusted topology user, and only afterwards reads and acts on the command\nfile that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without\nre-verifying its owner, so between the ownership change and the read the tenant can replace its contents.\n\nFor the Docker path the parsed command is executed with real uid 0, and the command sanitiser is not a\nprivilege boundary: it admits `-v` with an arbitrary source, `--device`, `--cap-add`, `--security-opt`,\n`--user` and `--net`, and copies positional arguments through verbatim. A rewritten file therefore yields an\nattacker-authored, root-equivalent container invocation with the host filesystem available.\n\nFor the OCI path the same rewrite window applies, and mount validation is structural only, with no\nsource or destination allow-list, so arbitrary host paths can be bind-mounted read-write into the\ncontainer. The `username` field of the command file is likewise attacker-settable and is checked only\nagainst non-root and minimum-uid rules, permitting execution as another tenant\u0027s uid.\n\nMitigation\n\nUpgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open,\nand where mount sources and destinations are constrained by configuration.\n\nUsers who cannot upgrade immediately should disable Docker and OCI worker isolation, or restrict topology\nsubmission on affected supervisors to trusted principals. Note that the launcher must be rebuilt and\nreinstalled after upgrading.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T14:15:58.744Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/8d5pkn486p8vrz5klg6onk5r8k9sd9lv"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-82430",
    "datePublished": "2026-09-14T14:15:58.744Z",
    "dateReserved": "2026-08-29T10:18:19.828Z",
    "dateUpdated": "2026-09-14T20:00:53.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-82430\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-09-14T15:17:09.930\",\"lastModified\":\"2026-09-14T20:58:48.430\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Description\\n\\nWhen launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the\\nentire worker directory to the untrusted topology user, and only afterwards reads and acts on the command\\nfile that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without\\nre-verifying its owner, so between the ownership change and the read the tenant can replace its contents.\\n\\nFor the Docker path the parsed command is executed with real uid 0, and the command sanitiser is not a\\nprivilege boundary: it admits `-v` with an arbitrary source, `--device`, `--cap-add`, `--security-opt`,\\n`--user` and `--net`, and copies positional arguments through verbatim. A rewritten file therefore yields an\\nattacker-authored, root-equivalent container invocation with the host filesystem available.\\n\\nFor the OCI path the same rewrite window applies, and mount validation is structural only, with no\\nsource or destination allow-list, so arbitrary host paths can be bind-mounted read-write into the\\ncontainer. The `username` field of the command file is likewise attacker-settable and is checked only\\nagainst non-root and minimum-uid rules, permitting execution as another tenant\u0027s uid.\\n\\nMitigation\\n\\nUpgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open,\\nand where mount sources and destinations are constrained by configuration.\\n\\nUsers who cannot upgrade immediately should disable Docker and OCI worker isolation, or restrict topology\\nsubmission on affected supervisors to trusted principals. Note that the launcher must be rebuilt and\\nreinstalled after upgrading.\\n\\nCredit\\n\\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Storm Worker Launcher\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"packageName\":\"org.apache.storm:storm-core\",\"versions\":[{\"version\":\"3.0.0\",\"lessThan\":\"3.1.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-14T20:00:33.467479Z\",\"id\":\"CVE-2026-82430\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-367\"}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/8d5pkn486p8vrz5klg6onk5r8k9sd9lv\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/09/13/10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-09-14T14:15:58.744Z\"}, \"title\": \"Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant\", \"problemTypes\": [{\"descriptions\": [{\"description\": \"CWE-367 Time-of-check time-of-use (TOCTOU) race condition\", \"lang\": \"en\", \"cweId\": \"CWE-367\", \"type\": \"CWE\"}]}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Storm Worker Launcher\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"packageName\": \"org.apache.storm:storm-core\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.1.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"value\": \"Description\\n\\nWhen launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the\\nentire worker directory to the untrusted topology user, and only afterwards reads and acts on the command\\nfile that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without\\nre-verifying its owner, so between the ownership change and the read the tenant can replace its contents.\\n\\nFor the Docker path the parsed command is executed with real uid 0, and the command sanitiser is not a\\nprivilege boundary: it admits `-v` with an arbitrary source, `--device`, `--cap-add`, `--security-opt`,\\n`--user` and `--net`, and copies positional arguments through verbatim. A rewritten file therefore yields an\\nattacker-authored, root-equivalent container invocation with the host filesystem available.\\n\\nFor the OCI path the same rewrite window applies, and mount validation is structural only, with no\\nsource or destination allow-list, so arbitrary host paths can be bind-mounted read-write into the\\ncontainer. The `username` field of the command file is likewise attacker-settable and is checked only\\nagainst non-root and minimum-uid rules, permitting execution as another tenant\u0027s uid.\\n\\nMitigation\\n\\nUpgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open,\\nand where mount sources and destinations are constrained by configuration.\\n\\nUsers who cannot upgrade immediately should disable Docker and OCI worker isolation, or restrict topology\\nsubmission on affected supervisors to trusted principals. Note that the launcher must be rebuilt and\\nreinstalled after upgrading.\\n\\nCredit\\n\\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.\", \"lang\": \"en\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cb\u003eDescription\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eWhen launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the\u003cbr\u003eentire worker directory to the untrusted topology user, and only afterwards reads and acts on the command\u003cbr\u003efile that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without\u003cbr\u003ere-verifying its owner, so between the ownership change and the read the tenant can replace its contents.\u003cbr\u003e\u003cbr\u003eFor the Docker path the parsed command is executed with real uid 0, and the command sanitiser is not a\u003cbr\u003eprivilege boundary: it admits `-v` with an arbitrary source, `--device`, `--cap-add`, `--security-opt`,\u003cbr\u003e`--user` and `--net`, and copies positional arguments through verbatim. A rewritten file therefore yields an\u003cbr\u003eattacker-authored, root-equivalent container invocation with the host filesystem available.\u003cbr\u003e\u003cbr\u003eFor the OCI path the same rewrite window applies, and mount validation is structural only, with no\u003cbr\u003esource or destination allow-list, so arbitrary host paths can be bind-mounted read-write into the\u003cbr\u003econtainer. The `username` field of the command file is likewise attacker-settable and is checked only\u003cbr\u003eagainst non-root and minimum-uid rules, permitting execution as another tenant\u0027s uid.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eMitigation\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eUpgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open,\u003cbr\u003eand where mount sources and destinations are constrained by configuration.\u003cbr\u003e\u003cbr\u003eUsers who cannot upgrade immediately should disable Docker and OCI worker isolation, or restrict topology\u003cbr\u003esubmission on affected supervisors to trusted principals. Note that the launcher must be rebuilt and\u003cbr\u003ereinstalled after upgrading.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eCredit\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.\"}]}], \"references\": [{\"url\": \"https://lists.apache.org/thread/8d5pkn486p8vrz5klg6onk5r8k9sd9lv\", \"tags\": [\"vendor-advisory\"]}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"The ASF using Claude Agents\", \"type\": \"finder\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.3\"}}, \"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/09/13/10\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-09-14T15:13:47.599Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-82430\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-14T20:00:33.467479Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-14T20:00:48.305Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-82430\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"apache\", \"dateReserved\": \"2026-08-29T10:18:19.828Z\", \"datePublished\": \"2026-09-14T14:15:58.744Z\", \"dateUpdated\": \"2026-09-14T20:00:53.152Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-82430

Vulnerability from fkie_nvd - Published: 2026-09-14 15:17 - Updated: 2026-09-14 20:58

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/8d5pkn486p8vrz5klg6onk5r8k9sd9lv
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/09/13/10

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.storm:storm-core",
          "product": "Apache Storm Worker Launcher",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Description\n\nWhen launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the\nentire worker directory to the untrusted topology user, and only afterwards reads and acts on the command\nfile that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without\nre-verifying its owner, so between the ownership change and the read the tenant can replace its contents.\n\nFor the Docker path the parsed command is executed with real uid 0, and the command sanitiser is not a\nprivilege boundary: it admits `-v` with an arbitrary source, `--device`, `--cap-add`, `--security-opt`,\n`--user` and `--net`, and copies positional arguments through verbatim. A rewritten file therefore yields an\nattacker-authored, root-equivalent container invocation with the host filesystem available.\n\nFor the OCI path the same rewrite window applies, and mount validation is structural only, with no\nsource or destination allow-list, so arbitrary host paths can be bind-mounted read-write into the\ncontainer. The `username` field of the command file is likewise attacker-settable and is checked only\nagainst non-root and minimum-uid rules, permitting execution as another tenant\u0027s uid.\n\nMitigation\n\nUpgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open,\nand where mount sources and destinations are constrained by configuration.\n\nUsers who cannot upgrade immediately should disable Docker and OCI worker isolation, or restrict topology\nsubmission on affected supervisors to trusted principals. Note that the launcher must be rebuilt and\nreinstalled after upgrading.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."
    }
  ],
  "id": "CVE-2026-82430",
  "lastModified": "2026-09-14T20:58:48.430",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-82430",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-14T20:00:33.467479Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T15:17:09.930",
  "references": [
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread/8d5pkn486p8vrz5klg6onk5r8k9sd9lv"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/13/10"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-PJCP-2M43-FMV9

Vulnerability from github – Published: 2026-09-14 15:32 – Updated: 2026-09-14 21:31

Details

Description

When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened without O_NOFOLLOW and without re-verifying its owner, so between the ownership change and the read the tenant can replace its contents.

For the Docker path the parsed command is executed with real uid 0, and the command sanitiser is not a privilege boundary: it admits -v with an arbitrary source, --device, --cap-add, --security-opt, --user and --net, and copies positional arguments through verbatim. A rewritten file therefore yields an attacker-authored, root-equivalent container invocation with the host filesystem available.

For the OCI path the same rewrite window applies, and mount validation is structural only, with no source or destination allow-list, so arbitrary host paths can be bind-mounted read-write into the container. The username field of the command file is likewise attacker-settable and is checked only against non-root and minimum-uid rules, permitting execution as another tenant's uid.

Mitigation

Upgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open, and where mount sources and destinations are constrained by configuration.

Users who cannot upgrade immediately should disable Docker and OCI worker isolation, or restrict topology submission on affected supervisors to trusted principals. Note that the launcher must be rebuilt and reinstalled after upgrading.

Credit

The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-82430"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-14T15:17:09Z",
    "severity": "HIGH"
  },
  "details": "Description\n\nWhen launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the\nentire worker directory to the untrusted topology user, and only afterwards reads and acts on the command\nfile that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without\nre-verifying its owner, so between the ownership change and the read the tenant can replace its contents.\n\nFor the Docker path the parsed command is executed with real uid 0, and the command sanitiser is not a\nprivilege boundary: it admits `-v` with an arbitrary source, `--device`, `--cap-add`, `--security-opt`,\n`--user` and `--net`, and copies positional arguments through verbatim. A rewritten file therefore yields an\nattacker-authored, root-equivalent container invocation with the host filesystem available.\n\nFor the OCI path the same rewrite window applies, and mount validation is structural only, with no\nsource or destination allow-list, so arbitrary host paths can be bind-mounted read-write into the\ncontainer. The `username` field of the command file is likewise attacker-settable and is checked only\nagainst non-root and minimum-uid rules, permitting execution as another tenant\u0027s uid.\n\nMitigation\n\nUpgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open,\nand where mount sources and destinations are constrained by configuration.\n\nUsers who cannot upgrade immediately should disable Docker and OCI worker isolation, or restrict topology\nsubmission on affected supervisors to trusted principals. Note that the launcher must be rebuilt and\nreinstalled after upgrading.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.",
  "id": "GHSA-pjcp-2m43-fmv9",
  "modified": "2026-09-14T21:31:39Z",
  "published": "2026-09-14T15:32:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82430"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/8d5pkn486p8vrz5klg6onk5r8k9sd9lv"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/13/10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-82430 (GCVE-0-2026-82430)

FKIE_CVE-2026-82430

GHSA-PJCP-2M43-FMV9

Tags

Sightings

Nomenclature