CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

Apache Storm's Nimbus daemon accepted the `uploadedJarLocation` argument of `submitTopology`/`submitTopologyWithOpts` as a server-side path and opened it directly, never verifying it pointed to a jar the caller had actually uploaded via `beginFileUpload`. An authenticated user with topology submission rights could therefore name any file readable by the Nimbus daemon user as their topology jar; Nimbus copies it into a topology blob whose ACL grants the submitter read access, letting them exfiltrate the contents through ordinary blob download RPCs. High-value targets include the Nimbus Kerberos keytab (which turns an ordinary tenant into a cluster administrator), Thrift and UI TLS private keys, and `storm.yaml` containing ZooKeeper authentication credentials. Any secured (non-local-mode) Storm deployment is affected, and in the documentation's default configuration — `nimbus.users` unset — every authenticated principal may submit topologies, so no elevated privilege is required. No CVSS score has been assigned, the flaw is not in CISA's KEV, and no public exploit is known (a PoC was reported privately to the Apache Storm PMC).

Do: Upgrade to Apache Storm 3.1.0, where the submitted jar location is canonicalised and must resolve inside the Nimbus inbox. If you cannot upgrade immediately, restrict topology submission to trusted principals via `nimbus.users` or `nimbus.groups`, and treat every file readable by the Nimbus daemon user as potentially exposed — rotate the Nimbus Kerberos keytab, any Thrift/UI TLS private keys, and ZooKeeper credentials in `storm.yaml`. Also review submitted topology jar blobs for content that does not match a legitimate topology jar. Local-mode deployments need no action.