Is CVE-2026-82432 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82432 being exploited in the wild.

How severe is CVE-2026-82432?

High severity, with a CVSS score of 8.1, published 14 September 2026.

Is there a fix for CVE-2026-82432?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82432 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-82432?

Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82432: Apache Storm Nimbus authorization bypass in rebalance and listBlobs

CVE-2026-82432 · Severity: high · CVSS 8.1 · Published 2026-09-14

Apache Storm's Nimbus is the master node that coordinates distributed stream processing clusters. A vulnerability allows a user with rebalance permissions to bypass blob storage access controls by introducing blob references they shouldn't have access to, and another flaw exposes all blob storage metadata to any network-connected user. This could enable unauthorized data access and information disclosure about the cluster's stored data.

Technologies: Apache Storm. Vendors: Apache.

Quick answers

Is CVE-2026-82432 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82432 being exploited in the wild.
How severe is CVE-2026-82432?: High severity, with a CVSS score of 8.1, published 14 September 2026.
Which products and versions are affected?: Apache Storm before 3.1.0.
Is there a fix for CVE-2026-82432?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82432 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-82432?: Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability consists of two authorization flaws in Apache Storm Nimbus. First, the rebalance operation accepts configuration overrides but fails to re-validate the topology.blobstore.map against the rebalancing caller's permissions (unlike submission-time validation), allowing an authorized user to inject blob references with ACLs they don't satisfy. Supervisors then localize these blobs into the topology working directory, exposing their contents. Second, the listBlobs RPC operation performs no authorization check and passes no subject context, unlike neighboring operations (getBlobMeta, beginBlobDownload), exposing all blob storage keys to any caller reaching the Nimbus Thrift port. The fix in version 3.1.0 applies full configuration validation at rebalance time and enforces authorization on listBlobs.

Affected products

Apache Storm before 3.1.0

Timeline

2026-09-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.