Apache Software Foundation Apache Storm Worker Launcher vulnerabilities

2 CVEs affecting Apache Software Foundation Apache Storm Worker Launcher, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-82430, published 2026-09-14.

More from Apache Software Foundation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-82430, published 2026-09-14. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads…
• CVE-2026-82429, published 2026-09-14. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full…