As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
Apache Storm Nimbus versions 3.0.0 before 3.1.0 contain an authorization bypass in the blobstore configuration validation. The vulnerability arises because Nimbus validates the topology blobstore map only at submission time but fails to re-validate when rebalance operations introduce configuration overrides, allowing authorized rebalance callers to bypass restrictions.
Why it matters: Organizations running vulnerable Apache Storm Nimbus versions must patch immediately, as an attacker with rebalance permissions can escalate privileges by modifying blobstore configurations that should be restricted.
- Source published
- First seen by Cybersecurity Tracker