CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
Apache Storm Nimbus blobstore authorization bypass via rebalance configuration overrides, fixed in 3.1.0.
CVE-2026-82432 (rated moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Nimbus validates topology.blobstore.map against the calling subject only at topology submission time. The rebalance operation accepts configuration overrides and strips a small set of keys but never re-runs that validation, so a caller authorized only to rebalance a topology can introduce an unauthorized blobstore map.
- Blobstore map validated only at submission, not during rebalance
- Rebalance config overrides can inject unauthorized blobstore entries
- Requires caller already authorized to rebalance the topology
- Affects storm-server 3.0.0 before 3.1.0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82432 | Authorization Bypass in Apache Storm Nimbus Blobstore via Rebalance Overrides | 8.1 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: moderate Affected versions: - Apache Storm Nimbus (org. apache. storm:storm-server) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.