CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Apache Storm's Nimbus master daemon accepted topology submissions containing attacker-controlled lists of blobstore keys (`dependency_jars` and `dependency_artifacts`) without validating their contents, then acted on those lists during topology cleanup and on leadership acquisition. A submitter who names a blob belonging to another topology, such as its -stormjar.jar, causes Nimbus to delete that blob when the attacker's own topology is cleaned up — and because the deletion runs as the Nimbus subject, the blobstore short-circuits its ACL check. Separately, listing a key that does not exist causes every Nimbus to surrender leadership immediately after acquiring it, requeueing indefinitely and leaving the cluster permanently leaderless and unable to schedule work, clean up topologies, or accept new submissions. Any Storm cluster prior to 3.1.0 that permits topology submission from untrusted or semi-trusted principals is affected. No public proof of concept or exploitation is known, and the issue is not in CISA's KEV catalog.

Do: Upgrade to Apache Storm 3.1.0, which refuses any submission whose dependency lists contain a key that is not a dependency blob or does not exist in the blobstore; because the fix validates only new submissions, also inspect Nimbus logs for dependency keys reported as missing and remove or resubmit any topology stored by an affected version that names them. If immediate upgrade is not possible, restrict topology submission to trusted principals. Watch for repeated leader elections with no stable Nimbus leader — a telltale symptom of the denial-of-service variant.