# CVE-2026-82441: Apache Storm Nimbus blobstore validation bypass

Source: https://junglewise.ai/threats/cve-2026-82441-apache-storm-nimbus-blobstore-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82441 · Severity: critical · CVSS 9.1 · Published 2026-09-14

Apache Storm's Nimbus cluster manager performs no validation of dependency blob references submitted by topology clients, allowing attackers to delete blobs belonging to other topologies or to cause cluster-wide leadership failures by referencing non-existent blobs. This breaks cluster availability and can lead to data loss of application artifacts.

Technologies: [Apache Storm](https://junglewise.ai/threats/technologies/storm). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82441 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82441 being exploited in the wild.

**How severe is CVE-2026-82441?** Critical severity, with a CVSS score of 9.1, published 14 September 2026.

**Which products and versions are affected?** Apache Storm before 3.1.0.

**Is there a fix for CVE-2026-82441?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82441 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-82441?** Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Storm's topology submission handling, where Nimbus accepts but does not validate lists of blobstore keys (`dependency_jars` and `dependency_artifacts`). An attacker can exploit this in two ways: (1) by submitting a topology that references another topology's blob (e.g., its `-stormjar.jar`), causing it to be deleted when the attacker's topology is cleaned up, since Nimbus performs deletions with elevated privileges that bypass ACL checks; (2) by submitting a topology referencing non-existent blobs, causing all Nimbus nodes to enter a leadership thrashing loop where they repeatedly acquire and surrender leadership, leaving the cluster without a leader and unable to schedule or accept new submissions. The attack requires the ability to submit topologies (typically restricted to trusted principals but potentially exploitable in multi-tenant environments). The fix in Storm 3.1.0 validates that all dependency keys are valid blobstore keys and exist before accepting a submission.

## Affected products

- Apache Storm before 3.1.0

## Timeline

- 2026-09-14: disclosed

## Related threats

- [Apache Storm Nimbus information disclosure in worker placement](https://junglewise.ai/threats/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on)
- [Apache Storm Logviewer symlink traversal in worker logs](https://junglewise.ai/threats/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves)
- [Apache Storm arbitrary class instantiation in scheduler](https://junglewise.ai/threats/cve-2026-82440-description-nimbus-instantiates-the-class-named-by-a-topology-s)
- [Apache Storm unsafe deserialization in state serialization](https://junglewise.ai/threats/cve-2026-82436-description-defaultstateserializer-used-to-persist-and-restore)
- [Apache Storm CORS misconfiguration allows credential-based data exposure](https://junglewise.ai/threats/cve-2026-82438-apache-storm-cors-misconfiguration-allows-credential-based-data)