CVE-2026-82432 Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...

CVE-2026-82432 Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...