# CVE-2026-82427: Apache Storm path traversal in blobstore symlink creation

Source: https://junglewise.ai/threats/cve-2026-82427-apache-storm-path-traversal-in-blobstore-symlink-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82427 · Severity: high · CVSS 7.8 · Published 2026-09-14

Apache Storm is a distributed stream processing system used to process large volumes of data in real-time. An attacker with topology submission privileges could exploit a path traversal vulnerability in the blobstore configuration to delete arbitrary supervisor-owned files or create malicious symlinks that allow code execution as another user, bypassing the intended tenant isolation.

Technologies: [Apache Storm](https://junglewise.ai/threats/technologies/storm). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82427 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82427 being exploited in the wild.

**How severe is CVE-2026-82427?** High severity, with a CVSS score of 7.8, published 14 September 2026.

**Which products and versions are affected?** Apache Storm before 3.1.0.

**Is there a fix for CVE-2026-82427?** A patch was published on 2026-09-14: Fix available in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82427 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-82427?** Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Storm's `AsyncLocalizer` and `Container.createBlobstoreLinks` components, which fail to normalize the `topology.blobstore.map` configuration. An attacker can craft a topology containing path traversal sequences (e.g., `../`) in blob names to direct delete-and-symlink operations at arbitrary paths on the supervisor node. Because the symlink creation forcibly deletes existing files before creating the link, an attacker can recursively delete supervisor-owned content or plant symlinks that cause subsequent worker processes to execute arbitrary code as a different tenant user. The attack requires topology submission privileges and affects all nodes where the topology is scheduled. A fix was released in version 3.1.0 that enforces path normalization checks at both call sites.

## Affected products

- Apache Storm before 3.1.0

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: Fix available in version 3.1.0

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/o0j51w6m0qdmwypvzfnd8w97s7ysnmyj](https://lists.apache.org/thread/o0j51w6m0qdmwypvzfnd8w97s7ysnmyj)

## Related threats

- [Apache Storm Nimbus information disclosure in worker placement](https://junglewise.ai/threats/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on)
- [Apache Storm Logviewer symlink traversal in worker logs](https://junglewise.ai/threats/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves)
- [Apache Storm arbitrary class instantiation in scheduler](https://junglewise.ai/threats/cve-2026-82440-description-nimbus-instantiates-the-class-named-by-a-topology-s)
- [Apache Storm unsafe deserialization in state serialization](https://junglewise.ai/threats/cve-2026-82436-description-defaultstateserializer-used-to-persist-and-restore)
- [Apache Storm CORS misconfiguration allows credential-based data exposure](https://junglewise.ai/threats/cve-2026-82438-apache-storm-cors-misconfiguration-allows-credential-based-data)