CVE-2026-82437

/// Technical description

Description

The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For

daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag

with the authorizer result in a way that discarded the authorizer's answer whenever the flag was set, and

the daemon log page and download endpoints reached the handler without consulting an authorizer at all. Any

user able to pass the configured servlet filter could therefore read `nimbus.log`, `supervisor.log` and the

other daemon logs on every reachable node, which contain other tenants' topology names, owners and

configuration fragments.

The same advisory covers the log listing endpoints, which accepted a user argument and never applied it, so

`/listLogs` and `/searchLogs` returned every tenant's topology and worker log file names regardless of the

caller. That part is metadata only.

There was no configuration that closed either behaviour.

Mitigation

Upgra

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References