Quick answers
- Is CVE-2026-82427 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82427 being exploited in the wild.
- How severe is CVE-2026-82427?
- High severity, with a CVSS score of 7.8, published 14 September 2026.
- Which products and versions are affected?
- Apache Storm before 3.1.0.
- Is there a fix for CVE-2026-82427?
- A patch was published on 2026-09-14: Fix available in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82427 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-82427?
- Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in Storm's `AsyncLocalizer` and `Container.createBlobstoreLinks` components, which fail to normalize the `topology.blobstore.map` configuration. An attacker can craft a topology containing path traversal sequences (e.g., `../`) in blob names to direct delete-and-symlink operations at arbitrary paths on the supervisor node. Because the symlink creation forcibly deletes existing files before creating the link, an attacker can recursively delete supervisor-owned content or plant symlinks that cause subsequent worker processes to execute arbitrary code as a different tenant user. The attack requires topology submission privileges and affects all nodes where the topology is scheduled. A fix was released in version 3.1.0 that enforces path normalization checks at both call sites.
Affected products
- Apache Storm before 3.1.0
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fix available in version 3.1.0