Apache Storm worker-launcher: TOCTOU on the command file gives a tenant root-equivalent container launch

Impact

The setuid-root worker-launcher chowns the whole worker directory to the untrusted topology user before it reads the supervisor-written command file, and it opens that file without O_NOFOLLOW and without re-checking ownership. A tenant that can submit a topology therefore has a window in which it rewrites the command file and gets the launcher to execute an attacker-authored container invocation as real uid 0. The sanitiser is not a boundary: it permits -v with an arbitrary source, --device, --cap-add, --security-opt, --user and --net, so the host filesystem and host devices can be mounted into the container. On a shared worker node that is full host compromise from a normal tenant submission, and the attacker-settable username field also allows running as another tenant's uid. The OCI path has the same rewrite window with structural-only mount validation, so arbitrary host paths can be bind-mounted read-write.

Who can reach it

Any authenticated principal allowed to submit a topology to an affected supervisor, when Docker or OCI worker isolation is enabled. Local code execution on the worker node as the topology user is what the window is exploited from.

What to do

Upgrade to Apache Storm 3.1.0, where the command file is validated before the ownership change and re-verified on open and mount sources and destinations are constrained by configuration. The launcher binary must be rebuilt and reinstalled on every supervisor after the upgrade, and supervisors restarted, so plan a rolling worker-node maintenance pass rather than a simple package bump. If you cannot upgrade now, disable Docker and OCI worker isolation, or restrict topology submission on affected supervisors to trusted principals.

References

Related entries

• SonicWall SMA1000: authenticated admin can inject OS commands through the management consoleCVE-2026-83549 · SonicWall SMA1000 appliance (Appliance Management Console, OS command injection)High
• CyberPower PowerPanel managed devices - shared device certificates: Every managed device uses an identical certificateCVE-2024-31410 · CyberPower PowerPanel managed devices - shared device certificatesHigh
• Keycloak: SAML signature scope determined by position, not ReferenceCVE-2024-8698 · KeycloakHigh
• Tridium Niagara Framework and Niagara Enterprise Security (before 4.10.11 / 4.14.2 / 4.15.1): A chain, not a singleCVE-2025-3937 · Tridium Niagara Framework and Niagara Enterprise Security (before 4.10.11 / 4.14.2 / 4.15.1)High
• BOSH vSphere CPI: missing certificate pinning lets an interceptor impersonate vCenter and capture admin credentialsCVE-2026-41012 · BOSH Director vSphere CPI (vCenter REST API certificate validation)High
• OpenTelemetry Operator TargetAllocator: a tenant ServiceMonitor can exfiltrate the Collector's service-account tokenCVE-2026-47701 · OpenTelemetry Operator TargetAllocator (ServiceMonitor bearerTokenFile handling)High