6 matches found
CVE-2026-82426
Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...
CVE-2026-82431
Description "SimpleACLAuthorizer" evaluated the user-level command set by returning early when "nimbus.users" was empty, before "nimbus.groups" was considered. An operator who restricted cluster access by group alone, leaving "nimbus.users" unset, therefore received no restriction at all: every...
CVE-2026-82426
Description Nimbus accepted the "uploadedJarLocation" argument of "submitTopology" / "submitTopologyWithOpts" as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls "beginFileUpload...
CVE-2026-82431: Incorrect Authorization
Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...
CVE-2026-82426: Improper Limitation of a Pathname to a Restricted Directory
Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...
PT-2026-91225
Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...