CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
Description
The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer whenever the flag was set, and the daemon log page and download endpoints reached the handler without consulting an authorizer at all. Any user able to pass the configured servlet filter could therefore read nimbus.log, supervisor.log and the other daemon logs on every reachable node, which contain other tenants' topology names, owners and configuration fragments.
The same advisory covers the log listing endpoints, which accepted a user argument and never applied it, so /listLogs and /searchLogs returned every tenant's topology and worker log file names regardless of the caller. That part is metadata only.
There was no configuration that closed either behaviour.
Mitigation
Upgrade to 3.1.0, where the daemon log paths evaluate the same configured user and group lists that the worker log paths already used, and the listing endpoints filter by the requesting user.
Users who cannot upgrade immediately should place the Logviewer behind a reverse proxy that restricts the daemon log endpoints, and should treat daemon log content as readable by any filter-authenticated user.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Storm Logviewerto a version that resolves this vulnerability.Fixed in 3.1.0 - Compensating control
For users who cannot upgrade immediately, place the Logviewer behind a reverse proxy that restricts access to the /listLogs and /searchLogs endpoints so they do not return other tenants' topology and worker log file names regardless of the caller.
- Compensating control
Treat daemon log content as readable by any filter-authenticated user, because in the affected behavior the daemon log paths and access decision are not consistently enforcing the configured logs.users/logs.groups and the servlet filter authorizer result is discarded when the 'this is a daemon log' flag is set.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any user who can pass the configured servlet filter can read daemon logs on every reachable node. This includes access to logs such as nimbus.log and supervisor.log.
Can the configured logs.users and logs.groups settings prevent the affected access?
No. There was no configuration that closed either the daemon-log access behavior or the unfiltered log-listing behavior.
What information can be disclosed?
Daemon logs can expose other tenants' topology names, owners, and configuration fragments. The listLogs and searchLogs endpoints disclose metadata only: topology and worker log file names for every tenant.
What remediation is available?
Upgrade to Apache Storm 3.1.0. In that release, daemon log paths apply the configured user and group lists, and listing endpoints filter results by the requesting user.