CVE-2026-82426

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

CVE-2026-82432 Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...

CVE-2026-82432

Apache Storm Nimbus contains an authorization bypass in its blobstore handling. The topology.blobstore.map field was validated against the calling subject only at topology submission time; the rebalance operation accepted configuration overrides but never re-ran that validation. A caller authoris...

EUVD-2026-77523

Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...

CVE-2026-82426

Apache Storm 's Nimbus component allowed an arbitrary file read via the uploadedJarLocation argument in submitTopology/submitTopologyWithOpts. The path was opened server-side without verifying it referred to a file the caller had uploaded, since the uploaders map was never consulted at submit tim...

CVE-2026-82426 Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

CVE-2026-82441

Apache Storm Nimbus accepts unvalidated dependency_jars and dependency_artifacts key lists from topology submissions, leading to two distinct issues. First, during topology cleanup Nimbus deletes the listed keys under its own subject (bypassing the blobstore ACL check), so a submitter can delete ...

CVE-2026-82441 Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...

EUVD-2026-77486

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...

CVE-2026-35337 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...