CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location
Apache Storm Nimbus 3.0.0 before 3.1.0 allows arbitrary server-side file read via unvalidated uploadedJarLocation in submitTopology calls.
CVE-2026-82426 (rated important) affects Apache Storm Nimbus (org.apache.storm:storm-server) versions 3.0.0 before 3.1.0. Nimbus accepted the uploadedJarLocation argument of submitTopology/submitTopologyWithOpts as a server-side path and opened it directly, without verifying the caller had actually uploaded that file via beginFileUpload. This enables arbitrary file read on the Nimbus host; the issue is fixed in version 3.1.0.
- CVE-2026-82426 rated important affects Apache Storm Nimbus 3.0.0 before 3.1.0
- uploadedJarLocation path opened server-side without verifying prior client upload
- Allows arbitrary file read on Nimbus server; fixed in Storm 3.1.0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82426 | Authenticated Arbitrary File Read in Apache Storm Nimbus via Unvalidated Jar Path | 6.5 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: important Affected versions: - Apache Storm Nimbus (org. apache. storm:storm-server) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.