CVE-2026-82427: Apache Storm Path Traversal Vulnerability

CVE-2026-82427 Overview

Apache Storm contains a path traversal vulnerability in the supervisor blobstore localization logic. The topology.blobstore.map submission field lets a topology submitter choose a local name for each blob localized by the supervisor. That name is concatenated into a path under the topology working directory without normalization in both AsyncLocalizer and Container.createBlobstoreLinks. The symlink helper force-deletes any existing target before creating the link.

A submitter can supply ../ segments to redirect the delete-and-symlink operation to arbitrary filesystem paths as the supervisor user on every node the topology is scheduled onto. The flaw is tracked as CWE-22.

Critical Impact
Attackers with topology submission rights can recursively delete supervisor-owned content and plant symlinks that cause worker launches to execute attacker code as another tenant's operating-system user, defeating the isolation provided by supervisor.run.worker.as.user.

Affected Products

Apache Storm versions prior to 3.1.0
Apache Storm supervisor nodes running multi-tenant topologies
Apache Storm deployments using supervisor.run.worker.as.user isolation

Discovery Timeline

2026-09-14 - CVE-2026-82427 published to NVD
2026-09-14 - Last updated in NVD database
Credit - The Apache Software Foundation, discovered using Claude agents to study open-source project security, validated and reported by Apache Storm

Technical Details for CVE-2026-82427

Vulnerability Analysis

Apache Storm supervisors localize blobs referenced by a topology into a working directory on each worker node. The mapping between the blobstore key and the local filename is controlled by the submitter through topology.blobstore.map. Storm treats the submitter-controlled local name as a trusted path component and joins it directly to the topology working directory root.

Because neither AsyncLocalizer nor Container.createBlobstoreLinks normalized the resolved path or verified it remained within the intended root, submitter-supplied ../ sequences escape the working directory. The symlink helper first removes anything at the target path, then creates a symlink pointing at the localized blob content. Both operations execute with supervisor user privileges on every host where the topology runs.

The outcome is twofold. First, arbitrary filesystem locations owned by the supervisor user can be recursively deleted. Second, an attacker can plant a symlink whose target is a script or binary launched by a subsequent worker start-up under a different tenant's OS user account, breaking the per-tenant isolation model.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory ([CWE-22]). Storm accepted submitter-controlled path segments and used them in filesystem operations without canonicalizing the result or checking containment against the expected root.

Attack Vector

Exploitation requires the ability to submit a topology to Nimbus. The attacker crafts a topology.blobstore.map entry whose local name contains .. segments and path separators. When the supervisor localizes the blob, the delete-and-symlink operation executes against the attacker-chosen path. On multi-tenant clusters, a subsequent worker launch will execute the planted symlink target as another tenant's user, yielding lateral code execution across tenants.

Detection Methods for CVE-2026-82427

Indicators of Compromise

Entries in topology.blobstore.map containing .., /, or \ characters in the local-name field.
Unexpected symlinks under supervisor-managed directories pointing outside the topology working directory root.
Missing or truncated supervisor-owned files and directories corresponding to force-delete operations at attacker-chosen paths.
Worker processes launching binaries or scripts from paths outside the localized blob tree.

Detection Strategies

Inspect Nimbus submission logs for topology configurations whose blobstore map keys deviate from expected naming conventions.
Audit supervisor working directories for symbolic links whose resolved targets fall outside the topology root.
Alert on file deletions performed by the supervisor user against paths outside the configured storm.local.dir.

Monitoring Recommendations

Enable filesystem auditing (auditd or equivalent) on supervisor hosts for unlink, symlink, and symlinkat syscalls issued by the supervisor process.
Forward Storm supervisor and Nimbus logs to a centralized analytics platform to correlate submission events with filesystem activity across nodes.
Track worker launch commands and compare executed binary paths against the expected localized blob paths.

How to Mitigate CVE-2026-82427

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0, which enforces that the resolved target lies inside the expected root at both call sites.
Restrict topology submission to trusted principals until upgrade is complete.
Reject any topology submission whose topology.blobstore.map local names contain path separators or .. segments before they reach Nimbus.

Patch Information

Apache Storm 3.1.0 resolves the vulnerability by validating that the resolved blob target path remains within the expected topology working directory in both AsyncLocalizer and Container.createBlobstoreLinks. Refer to the Apache Mailing List Discussion and the Openwall OSS-Security Update for advisory details.

Workarounds

Limit topology submission privileges to a small set of vetted principals authenticated through Nimbus.
Implement a submission-time validator that rejects topology.blobstore.map entries containing /, \, or .. in the local-name field.
Monitor supervisor filesystem activity for symlink creation and file deletion operations targeting paths outside storm.local.dir.

bash

# Example pre-submission validation logic (pseudo-shell)
# Reject blobstore map entries whose local names contain path separators or traversal segments
for name in $(jq -r '."topology.blobstore.map" | keys[]' topology.json); do
  case "$name" in
    *..*|*/*|*\\*) echo "REJECT: unsafe blob local name: $name"; exit 1 ;;
  esac
done