Cross-Topology Blob Deletion and Leaderless-Cluster DoS in Apache Storm Nimbus
CVSS 3.1
9.1critical
EPSS
—
Published
()
Modified
AI analysis
Apache Storm's Nimbus master daemon accepted topology submissions containing attacker-controlled lists of blobstore keys (`dependency_jars` and `dependency_artifacts`) without validating their contents, then acted on those lists during topology cleanup and on leadership acquisition. A submitter who names a blob belonging to another topology, such as its -stormjar.jar, causes Nimbus to delete that blob when the attacker's own topology is cleaned up — and because the deletion runs as the Nimbus subject, the blobstore short-circuits its ACL check. Separately, listing a key that does not exist causes every Nimbus to surrender leadership immediately after acquiring it, requeueing indefinitely and leaving the cluster permanently leaderless and unable to schedule work, clean up topologies, or accept new submissions. Any Storm cluster prior to 3.1.0 that permits topology submission from untrusted or semi-trusted principals is affected. No public proof of concept or exploitation is known, and the issue is not in CISA's KEV catalog.
What to do: Upgrade to Apache Storm 3.1.0, which refuses any submission whose dependency lists contain a key that is not a dependency blob or does not exist in the blobstore; because the fix validates only new submissions, also inspect Nimbus logs for dependency keys reported as missing and remove or resubmit any topology stored by an affected version that names them. If immediate upgrade is not possible, restrict topology submission to trusted principals. Watch for repeated leader elections with no stable Nimbus leader — a telltale symptom of the denial-of-service variant.
Affected
Apache Storm
all versions prior to 3.1.0 (fixed in 3.1.0)
Estimated exposure
niche≈ low thousands of Apache Storm clusters worldwide (estimate), with only those accepting topology submissions from untrusted principals directly at risk — Apache Storm is a legacy on-premise stream-processing platform with no public install-base telemetry, public scans typically show only a small number of internet-exposed Storm endpoints, and exploitation requires authenticated…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup of a finished topology, Nimbus deletes the keys named in those lists, and the deletion is performed as the Nimbus subject, for which the blobstore short-circuits its ACL check. A submitter who listed a key belonging to another topology, such as its `-stormjar.jar`, could therefore cause that blob to be deleted when their own topology was cleaned up. Separately, on acquiring leadership a Nimbus compares the dependency keys of all active topologies against the blobstore contents and surrenders leadership if any is missing. A single key that does not exist, on a single active topology, therefore causes every Nimbus to acquire leadership, surrender it and requeue indefinitely, leaving the cluster without a leader and unable to schedule, clean up or accept submissions. Mitigation Upgrade to 3.1.0, where a submission is refused unless every entry in both lists is a dependency blob key and exists in the blobstore. Note that this validates new submissions only; a topology stored by an affected version with an invalid list is unaffected by the upgrade. An operator whose cluster is failing to retain a leader should inspect the Nimbus log for the dependency keys reported as missing and remove or resubmit the topology naming them. Users who cannot upgrade immediately should restrict topology submission to trusted principals. Credit This issue was discovered by rzo1 while investigating an unrelated blobstore defect.
Unvalidated topology dependency keys in Apache Storm Nimbus 3.0.0 enable cross-tenant blob deletion and cluster denial of service.
CVE-2026-82441 (severity: moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Topology submissions carry dependency_jars and dependency_artifacts blobstore key lists that Nimbus never validated on the submission path, yet acted on during cleanup of finished topologies. A malicious submitter could reference arbitrary blobstore keys, causing cross-tenant blob deletion and cluster-wide denial of service.