Skip to content
Fencer Intel
low —

CVE-2026-124495 json

Apache Storm: Logviewer follows worker symlinks across topology ACLs

published 22h ago modified 15h ago also EUVD-2026-123411

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

Patch / fix

  • maven org.apache.storm:storm-webapp 3.2.0
  • Apache Software Foundation Apache Storm 3.2.0

Is CVE-2026-124495 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
maven org.apache.storm:storm-webapp
>=3.0.0, <3.2.0
3.2.0

Affected products

  • Apache Software Foundation Apache Storm

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.