CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name
Unsanitised topology.blobstore.map local names in Apache Storm enable path traversal writes on supervisors as the supervisor user.
CVE-2026-82427 affects Apache Storm Nimbus (org.apache.storm:storm-server) versions 3.0.0 before 3.1.0, rated important. Topology submitters can choose a local name for each blob in topology.blobstore.map, which AsyncLocalizer and Container.createBlobstoreLinks used to build paths under the topology's working directory without normalisation. Crafted names allow path traversal, letting a submitter create or overwrite files outside the intended directory on supervisors, with symlink handling also affected. Fixed in version 3.1.0.
- Affects Apache Storm Nimbus 3.0.0 before 3.1.0
- Blob local names used unnormalised in AsyncLocalizer and Container.createBlobstoreLinks
- Traversal enables writing files outside the topology working directory on supervisors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82427 | Path Traversal in Apache Storm Blobstore Map Enables Arbitrary Deletion, Cross-Tenant RCE | 7.8 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: important Affected versions: - Apache Storm Nimbus (org. apache. storm:storm-server) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.