CVE-2026-82426: Apache Storm Path Traversal Vulnerability

CVE-2026-82426 Overview

Apache Storm's Nimbus daemon accepts the uploadedJarLocation argument of submitTopology and submitTopologyWithOpts as a server-side path and opens it directly. Nimbus never checks that the path refers to a file the caller actually uploaded through beginFileUpload. An authenticated principal with topology submission rights can therefore submit any file readable by the Nimbus daemon user as their topology jar. The file is copied into the topology blob, and the blob ACL grants the submitter read access. This exposes sensitive artifacts such as the Nimbus Kerberos keytab, Thrift and UI TLS private keys, and storm.yaml. The vulnerability is classified as path traversal [CWE-22].

Critical Impact
An authenticated tenant can exfiltrate the Nimbus Kerberos keytab and become a full cluster administrator.

Affected Products

Apache Storm versions prior to 3.1.0
Nimbus daemon component
Deployments where nimbus.users is unset (default documented configuration)

Discovery Timeline

2026-09-14 - CVE-2026-82426 published to NVD
2026-09-14 - Last updated in NVD database
Independently reported to the Apache Storm PMC by n0mi1k with a proof of concept, and additionally identified by the ASF using Claude agents to study open-source project security

Technical Details for CVE-2026-82426

Vulnerability Analysis

Nimbus exposes a Thrift RPC surface for topology submission. The intended upload flow requires a client to call beginFileUpload, which returns a path inside the Nimbus inbox, followed by chunked uploads to that location. The uploaders map populated by beginFileUpload tracks legitimate uploads. At submission time, however, Nimbus never consults this map. Instead it opens whatever path the caller supplies in uploadedJarLocation. This decoupling breaks the trust boundary between client-controlled input and server-side file access.

Root Cause

The root cause is missing canonicalisation and inbox containment checks on the uploadedJarLocation parameter. Nimbus treats a client-supplied string as an authoritative server path without validating that the path resolves inside the Nimbus inbox directory. The uploaders allowlist exists but is never enforced during submitTopology or submitTopologyWithOpts.

Attack Vector

An authenticated user with submission rights invokes submitTopology and passes an absolute path such as the Nimbus Kerberos keytab, a TLS private key file, or storm.yaml. Nimbus copies that file into the topology's jar blob. The submitting subject holds read access on the blob ACL, so the attacker retrieves the file contents through ordinary blob download RPCs. When nimbus.users is unset, submission is available to every authenticated principal, so no elevated privilege is required. Possession of the Nimbus keytab elevates an ordinary tenant to cluster administrator. Local mode is unaffected. See the Apache Mailing List Thread for the maintainer discussion.

Detection Methods for CVE-2026-82426

Indicators of Compromise

Nimbus audit or Thrift logs showing submitTopology calls where uploadedJarLocation points outside the configured Nimbus inbox directory.
Blob download RPCs immediately following a topology submission from the same principal, especially for topologies that never execute.
Unexpected access patterns against files such as nimbus.keytab, storm.yaml, or TLS private key paths by the Nimbus daemon user.

Detection Strategies

Parse Nimbus logs and alert when uploadedJarLocation does not canonicalise into the inbox path prefix.
Correlate submitTopology events with prior beginFileUpload sessions from the same principal; flag submissions without a matching upload.
Baseline normal topology submission behavior per tenant and alert on anomalous jar sizes or non-jar file signatures in blob storage.

Monitoring Recommendations

Enable Nimbus Thrift request logging with full argument capture and forward to a centralized analytics platform.
Monitor filesystem reads by the Nimbus daemon user against sensitive paths using host-based auditing such as auditd.
Track blob storage download activity per principal and alert on retrieval of blobs whose source jars contain non-Java content.

How to Mitigate CVE-2026-82426

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0, which canonicalises uploadedJarLocation and requires it to resolve inside the Nimbus inbox.
Restrict topology submission to trusted principals by setting nimbus.users or nimbus.groups if immediate upgrade is not possible.
Rotate the Nimbus Kerberos keytab, Thrift and UI TLS private keys, and any ZooKeeper credentials reachable from the Nimbus daemon account.
Audit historical Nimbus submissions for evidence of path-traversal exploitation prior to remediation.

Patch Information

Apache Storm 3.1.0 canonicalises the submitted location and enforces that it resolves inside the Nimbus inbox directory. Refer to the OpenWall OSS-Security Update for the coordinated disclosure notice.

Workarounds

Set nimbus.users or nimbus.groups to restrict submitTopology access to a small set of trusted principals.
Treat every file readable by the Nimbus daemon user as potentially exposed and remove unnecessary secrets from that account's reach.
Isolate Nimbus on a dedicated host so that sensitive files owned by other services are not reachable through the daemon user.

bash

# Configuration example - storm.yaml
nimbus.users:
  - "storm-admin"
  - "topology-operator"
nimbus.groups:
  - "storm-ops"