CVE-2026-82432

Apache Storm's Nimbus daemon validated the `topology.blobstore.map` configuration only at topology submission time, not when configuration overrides were supplied through the rebalance operation, so any caller authorized to rebalance a topology — including members of its `topology.users` or `topology.groups` — could name a blob whose ACL does not grant them access; Supervisors then localize that blob's contents into the topology's working directory, giving the rebalancer an unauthorized read of the blob. The same advisory covers the `listBlobs` Thrift operation, which performed no authorization check and passed no subject, returning every key in the blobstore to any caller able to reach the Nimbus Thrift port — this key-name disclosure (metadata only on its own) is what makes the blobstore read practical. An attacker therefore gains unauthorized access to blob contents, which in Storm deployments can include code, credentials, or other sensitive artifacts. Affected installations are those running Apache Storm Nimbus with authorization configured on versions prior to the 3.1.0 release. No public proof of concept exists and no exploitation has been reported.

What to do: Upgrade to Apache Storm 3.1.0, where rebalance configuration overrides are validated against the rebalancing caller exactly as submission-time configuration, and `listBlobs` applies the configured authorization. If immediate upgrade is not possible, restrict rebalance rights to trusted principals — noting that membership in a topology's `topology.users` or `topology.groups` confers them — and limit network access to the Nimbus Thrift port to trusted clients only. Review the blobstore for sensitive blobs and audit past rebalance operations for unexpected `topology.blobstore.map` overrides or unexplained `listBlobs` calls.