CVE-2026-82427

Apache Storm prior to 3.1.0 does not normalize the local file name a topology submitter chooses in 'topology.blobstore.map', and uses that name to build a path under the topology's working directory in both AsyncLocalizer and Container.createBlobstoreLinks, where the symlink helper force-deletes whatever already exists at the target before creating the link. By embedding '../' segments in a blob's local name, a submitter can direct this delete-and-symlink operation at arbitrary paths, running as the supervisor user, on every node the topology is scheduled onto. The consequences include recursive deletion of supervisor-owned content and planting a symlink that makes a subsequent worker launch execute attacker-chosen code as another tenant's operating-system user, defeating the isolation that 'supervisor.run.worker.as.user' is intended to provide. Any organization running a pre-3.1.0 cluster where less-than-fully-trusted users or services can submit topologies — especially multi-tenant clusters — is affected, though the flaw requires submitter access rather than mere network reachability. No exploitation is known, no public proof of concept exists, the CVE is not in CISA's KEV, and a CVSS score has not yet been assigned.

What to do: Upgrade to Apache Storm 3.1.0, where the resolved target must lie inside the expected root at both vulnerable call sites. If you cannot upgrade immediately, restrict topology submission to trusted principals and reject submissions whose 'topology.blobstore.map' entries contain path separators or '..' segments before they reach Nimbus. Check supervisor nodes for unexpected recursive deletions of supervisor-owned content or planted symlinks under topology working directories, and treat any findings as a potential tenant-isolation compromise.