# CVE-2026-82426: Apache Storm arbitrary file read via topology submission

Source: https://junglewise.ai/threats/cve-2026-82426-apache-storm-arbitrary-file-read-via-topology-submission  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82426 · Severity: medium · CVSS 6.5 · Published 2026-09-14

Apache Storm is a distributed stream processing system used to process real-time data across clusters. A vulnerability in the topology submission mechanism allows authenticated users to read arbitrary files on the Nimbus server—including encryption keys, authentication credentials, and configuration files—without proper validation of the uploaded jar location. An attacker could obtain the Nimbus Kerberos keytab to escalate from a regular user to cluster administrator.

Technologies: [Apache Storm](https://junglewise.ai/threats/technologies/storm). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82426 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82426 being exploited in the wild.

**How severe is CVE-2026-82426?** Medium severity, with a CVSS score of 6.5, published 14 September 2026.

**Which products and versions are affected?** Apache Storm before 3.1.0.

**Is there a fix for CVE-2026-82426?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82426 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82426?** Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an inadequate path validation flaw in the `submitTopology` and `submitTopologyWithOpts` RPC methods. The Nimbus daemon accepts a server-side file path as the `uploadedJarLocation` parameter without verifying that the path refers to a file previously uploaded by the caller via `beginFileUpload`. An authenticated user can supply an arbitrary readable path (e.g., `/etc/passwd`, the Kerberos keytab, or TLS private keys) to the submission RPC. Nimbus then copies the specified file into the topology jar blob, and the blob ACL grants the submitter read access, allowing them to retrieve sensitive files via standard blob download RPCs. Attack requires authentication and topology submission rights, though these are granted to all authenticated principals by default when `nimbus.users` is unset. Patched in version 3.1.0 with path canonicalization and validation that submission paths must resolve inside the Nimbus inbox.

## Affected products

- Apache Storm before 3.1.0

## Timeline

- 2026-09-14: disclosed

## Related threats

- [Apache Storm Nimbus information disclosure in worker placement](https://junglewise.ai/threats/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on)
- [Apache Storm Logviewer symlink traversal in worker logs](https://junglewise.ai/threats/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves)
- [Apache Storm arbitrary class instantiation in scheduler](https://junglewise.ai/threats/cve-2026-82440-description-nimbus-instantiates-the-class-named-by-a-topology-s)
- [Apache Storm unsafe deserialization in state serialization](https://junglewise.ai/threats/cve-2026-82436-description-defaultstateserializer-used-to-persist-and-restore)
- [Apache Storm CORS misconfiguration allows credential-based data exposure](https://junglewise.ai/threats/cve-2026-82438-apache-storm-cors-misconfiguration-allows-credential-based-data)