CVE-2026-82430

Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...

CVE-2026-82430

CVE-2026-82430 affects the setuid-root worker-launcher in Apache Storm . A TOCTOU race condition occurs because the launcher changes ownership of the worker directory to the untrusted topology user before reading the command file, which is opened without O_NOFOLLOW and without re-verifying its ow...