CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

<p>Posted by Richard Zowalla on Sep 13</p>Severity: important <br /> <br /> Affected versions:<br /> <br /> - Apache Storm Worker Launcher (org.apache.storm:storm-core) 3.0.0 before 3.1.0<br /> <br /> Description:<br /> <br /> Description<br /> <br /> The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking<br /> the tree with FTS and calling `lch