Insecure Log File Access in Apache Logviewer Affecting User Topologies

CVE-2026-124495

What is CVE-2026-124495?

The Apache Logviewer is vulnerable to an information exposure issue when utilized under certain user permissions. Specifically, when workers operate as the topology owner, the Logviewer may serve files from the worker's log directory as links to other files. This allows users authorized to submit topologies to inadvertently gain access to the logs of other users’ topologies. As a result, sensitive information may be disclosed. To address this vulnerability, users are strongly recommended to upgrade to version 3.2.0 or later, which mitigates this access issue.

References