CVE-2026-82437

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

CVE-2026-82437

The Apache Storm Logviewer suffers from a flaw where log access controls are not enforced for daemon logs. Specifically, the system incorrectly discards authorizer results when a "this is a daemon log" flag is set, and certain endpoints reach handlers without consulting an authorizer. This allows...

CVE-2026-82437 Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

GHSA-R9PV-HG64-JQRP Exposure of Sensitive Information in Apache Storm Logviewer

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...