CVE-2026-82441: Apache Storm Nimbus blobstore validation bypass

CVE-2026-82441 · Severity: critical · CVSS 9.1 · Published 2026-09-14

Apache Storm's Nimbus cluster manager performs no validation of dependency blob references submitted by topology clients, allowing attackers to delete blobs belonging to other topologies or to cause cluster-wide leadership failures by referencing non-existent blobs. This breaks cluster availability and can lead to data loss of application artifacts.

Technologies: Apache Storm. Vendors: Apache.

Quick answers

Is CVE-2026-82441 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82441 being exploited in the wild.
How severe is CVE-2026-82441?
Critical severity, with a CVSS score of 9.1, published 14 September 2026.
Which products and versions are affected?
Apache Storm before 3.1.0.
Is there a fix for CVE-2026-82441?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82441 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-82441?
Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Storm's topology submission handling, where Nimbus accepts but does not validate lists of blobstore keys (`dependency_jars` and `dependency_artifacts`). An attacker can exploit this in two ways: (1) by submitting a topology that references another topology's blob (e.g., its `-stormjar.jar`), causing it to be deleted when the attacker's topology is cleaned up, since Nimbus performs deletions with elevated privileges that bypass ACL checks; (2) by submitting a topology referencing non-existent blobs, causing all Nimbus nodes to enter a leadership thrashing loop where they repeatedly acquire and surrender leadership, leaving the cluster without a leader and unable to schedule or accept new submissions. The attack requires the ability to submit topologies (typically restricted to trusted principals but potentially exploitable in multi-tenant environments). The fix in Storm 3.1.0 validates that all dependency keys are valid blobstore keys and exist before accepting a submission.

Affected products

  • Apache Storm before 3.1.0

Timeline

  • 2026-09-14: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.