As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
Apache Storm Nimbus versions 3.0.0 before 3.1.0 contain an authorization bypass in the blobstore configuration validation. The vulnerability arises because Nimbus validates the topology blobstore map only at submission time but fails to re-validate when rebalance operations introduce configuration overrides, allowing authorized rebalance callers to bypass restrictions.
Why it matters: Organizations running vulnerable Apache Storm Nimbus versions must patch immediately, as an attacker with rebalance permissions can escalate privileges by modifying blobstore configurations that should be restricted.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
Apache Storm Nimbus versions before 3.1.0 contain an authorization bypass in the blobstore map validation. The vulnerability allows a caller authorized to rebalance a topology to override the blobstore configuration without re-validation, potentially introducing unauthorized blob storage mappings.
Why it matters: Organizations running Apache Storm Nimbus 3.0.0 and earlier should upgrade to 3.1.0 to prevent authorized users from bypassing blob storage access controls during topology rebalancing operations.
- Source published
- First seen by Cybersecurity Tracker