CVE-2026-82441

Apache Storm Nimbus is vulnerable to two issues stemming from unvalidated dependency_jars and dependency_artifacts lists in submitted topologies. First, during topology cleanup, Nimbus deletes listed keys as its own subject (short-circuiting the blobstore ACL check), allowing a submitter to cause...

CVE-2026-82441 Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...