Executive brief
Apache Storm's Nimbus is the master node that coordinates distributed stream processing clusters. A vulnerability allows a user with rebalance permissions to bypass blob storage access controls by introducing blob references they shouldn't have access to, and another flaw exposes all blob storage metadata to any network-connected user. This could enable unauthorized data access and information disclosure about the cluster's stored data.
Technical details
The vulnerability consists of two authorization flaws in Apache Storm Nimbus. First, the rebalance operation accepts configuration overrides but fails to re-validate the topology.blobstore.map against the rebalancing caller's permissions (unlike submission-time validation), allowing an authorized user to inject blob references with ACLs they don't satisfy. Supervisors then localize these blobs into the topology working directory, exposing their contents. Second, the listBlobs RPC operation performs no authorization check and passes no subject context, unlike neighboring operations (getBlobMeta, beginBlobDownload), exposing all blob storage keys to any caller reaching the Nimbus Thrift port. The fix in version 3.1.0 applies full configuration validation at rebalance time and enforces authorization on listBlobs.
Affected products
- Apache Storm before 3.1.0
Timeline
- 2026-09-14: disclosed