Apache Software Foundation Apache Storm Nimbus vulnerabilities

CVE-2026-82432 [HIGH] CWE-863 CVE-2026-82432: Description Nimbus validated `topology.blobstore.map` against the calling subject at submission tim Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could introduce a blobstore map entry naming a blob whose ACL doe

CVE-2026-82441 [CRITICAL] CWE-20 CVE-2026-82441: Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `depend Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup of a finished topology, Nimbus deletes the key

CVE-2026-82427 [HIGH] CWE-22 CVE-2026-82427: Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each b Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both `AsyncLocalizer` and `Container.createBlobstoreLinks`, and the symlink helper force-deletes whatever already exists

CVE-2026-82433 [MEDIUM] CWE-522 CVE-2026-82433: Description `getNimbusConf` returned the complete daemon configuration without redaction after only Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes `storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration. The project masks passw

CVE-2026-82426 [MEDIUM] CWE-22 CVE-2026-82426: Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopolog Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls `beginFileUpload`, which returns a path inside the Nimbus inbox, and up

CVE-2026-82434 [MEDIUM] CWE-522 CVE-2026-82434: Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeepe Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose only grant was the ability to view a topology received

CVE-2026-84179 [MEDIUM] CWE-200 CVE-2026-84179: Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own co Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/{id} and of the corresponding metrics endpoint. Where the cl