As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
Apache Storm Nimbus versions 3.0.0 before 3.1.0 fail to validate topology dependency keys, allowing an attacker to delete arbitrary blobs belonging to other tenants and disrupt cluster operations. The vulnerability stems from insufficient input validation on the `dependency_jars` and `dependency_artifacts` parameters during topology submission.
Why it matters: Storm operators running affected versions face cross-tenant data loss and denial of service attacks from authenticated users who can manipulate topology submissions to delete blobs outside their scope.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
CVE-2026-82441 affects Apache Storm Nimbus versions 3.0.0 before 3.1.0, where unvalidated topology dependency keys allow attackers to delete blobs across tenants and cause cluster denial of service. The vulnerability exists because Nimbus does not validate the contents of dependency_jars and dependency_artifacts lists submitted with topologies before acting on them during cleanup operations.
Why it matters: Organizations running affected Apache Storm Nimbus versions should upgrade to 3.1.0 or later to prevent cross-tenant blob deletion and cluster disruption attacks from submitted topologies.
- Source published
- First seen by Cybersecurity Tracker