CVE-2026-82429: Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking
Summary
A vulnerability exists in the `worker-launcher` binary (a program that runs with root privileges) that allows an attacker to redirect file ownership and permission changes to arbitrary files on the system. By replacing directory names with symbolic links (shortcuts to other files or directories) between when the system checks a file and when it modifies it, an untrusted user can trick the root-privileged program into modifying files they shouldn't be able to access. This attack can be repeated as many times as needed.
Solution / Mitigation
Upgrade to version 3.1.0, where the privileged walk operates on file descriptors (references to open files that don't need path re-resolution) rather than on pathnames re-resolved at call time. Note that the launcher must be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient. Users who cannot upgrade immediately should disable untrusted topology code on supervisors configured with `supervisor.run.worker.as.user`.
Vulnerability Details
EPSS: 0.0%
September 14, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82429
First tracked: September 14, 2026 at 02:11 PM
Classified by LLM (prompt v3) · confidence: 95%