{"cve":"CVE-2026-82437","nvd":{"published":"2026-09-14T15:17:10.757","modified":"2026-09-14T20:58:48.430","status":"Deferred","description":"Description\n\nThe Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For\ndaemon logs those settings were not applied: the access decision combined the \"this is a daemon log\" flag\nwith the authorizer result in a way that discarded the authorizer's answer whenever the flag was set, and\nthe daemon log page and download endpoints reached the handler without consulting an authorizer at all. Any\nuser able to pass the configured servlet filter could therefore read `nimbus.log`, `supervisor.log` and the\nother daemon logs on every reachable node, which contain other tenants' topology names, owners and\nconfiguration fragments.\n\nThe same advisory covers the log listing endpoints, which accepted a user argument and never applied it, so\n`/listLogs` and `/searchLogs` returned every tenant's topology and worker log file names regardless of the\ncaller. That part is metadata only.\n\nThere was no configuration that closed either behaviour.\n\nMitigation\n\nUpgrade to 3.1.0, where the daemon log paths evaluate the same configured user and group lists that the\nworker log paths already used, and the listing endpoints filter by the requesting user.\n\nUsers who cannot upgrade immediately should place the Logviewer behind a reverse proxy that restricts the\ndaemon log endpoints, and should treat daemon log content as readable by any filter-authenticated user.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-862"],"references":["https://lists.apache.org/thread/hqyj3spllmbj6vg9vmx29b1tjhzysdkl","http://www.openwall.com/lists/oss-security/2026/09/13/16"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-82437","score":0.00281,"percentile":0.20628,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}