CVE-2026-82432
HighCVSS 8.1Summary
In Apache Storm before 3.1.0, the rebalance operation does not revalidate the blobstore map for permissions, and listBlobs lacks authorization checks, allowing an authorized user to access disallowed blobs and disclose metadata.
Risk Assessment
Risk of unauthorized access to blobs and potential data exposure.
Recommendation
Upgrade to 3.1.0, restrict rebalance rights, and enforce authorization for listBlobs.
Other vulnerabilities in Apache Storm
See all- CVE-2026-82433Medium
In Apache Storm before 3.1.0, the getNimbusConf function returns full configuration without redaction, and the UI endpoint /api/v1/cluster/configuration lacks proper authorization, potentially exposing passwords and keys.
- CVE-2026-82428High
This vulnerability in Apache Storm affects the `storm jar --artifacts` feature, where dependency artifacts are stored under a blob key derived solely from the Maven coordinate, making it predictable and shared across all users. If the blob already exists, it is silently reused without owner verification, allowing an attacker to control the data that other submitters receive, leading to code execution in another tenant's topology.
- CVE-2026-82427High
A vulnerability in Apache Storm allows an attacker to use relative path segments (../) in the `topology.blobstore.map` to force deletion and symlink creation at arbitrary locations, acting as the supervisor user. This can lead to recursive deletion of data and replacement of symlinks, which when workers are launched enables execution of attacker-chosen code as another tenant's OS user, breaking isolation.
- CVE-2026-82426Medium
A vulnerability in Apache Storm allows an authenticated user with topology submission rights to specify any server-side path as the topology jar, bypassing the intended file upload flow. Nimbus opens the path without verifying it was uploaded, enabling access to files readable by the Nimbus daemon user.
- CVE-2026-84179Medium
Vulnerability in Apache Storm allows unauthorized users to read credential data (e.g., storm.zookeeper.auth.payload, keystore/truststore passwords) via the topology API, because Nimbus daemon configuration is merged with topology configuration and returned without redaction.
- CVE-2014-0115High
Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.
- CVE-2026-82435Critical
In Apache Storm before 3.1.0, a vulnerability exists: the Netty decoder is installed before authentication and processes frames without verification, allowing an unauthenticated attacker to allocate large buffers and potentially cause memory pressure on workers.
- CVE-2026-82439Critical
The DRPC server in Apache Storm keeps a map from function names to request queues, and entries are never removed. An attacker can send arbitrary function names without authentication (as `drpc.authorizer` is disabled by default), leading to unbounded memory growth and eventual heap exhaustion.
- CVE-2015-3188Critical
The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.
Original NVD description (English source)
Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could introduce a blobstore map entry naming a blob whose ACL does not grant them access. Supervisors localise whatever key the map names, placing the blob's contents into the topology's working directory. The same advisory covers `listBlobs`, which performed no authorization check and passed no subject, unlike the neighbouring `getBlobMeta` and `beginBlobDownload` operations. It therefore returned every key in the blobstore to any caller able to reach the Nimbus Thrift port, which provides the key names that make the above practical. On its own the disclosure is metadata only. Mitigation Upgrade to 3.1.0, where rebalance configuration overrides are validated exactly as submission-time configuration is, against the rebalancing caller, and where `listBlobs` applies the configured authorization. Users who cannot upgrade immediately should restrict rebalance rights to trusted principals, keeping in mind that membership of a topology's `topology.users` or `topology.groups` confers them. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.