CVE-2026-82432 Overview
CVE-2026-82432 is an authorization flaw in Apache Storm's Nimbus service. The Nimbus daemon validates topology.blobstore.map against the calling subject only at topology submission time. The rebalance operation accepts configuration overrides but never re-runs that validation. A caller authorized to rebalance a topology can inject a blobstore map entry referencing a blob whose access control list (ACL) does not grant them access. Supervisors then localize the referenced blob into the topology's working directory. The same advisory covers listBlobs, which lacks authorization checks and returns every blobstore key to any caller able to reach the Nimbus Thrift port.
Critical Impact
Authenticated users with rebalance rights can read arbitrary blobs from the Storm blobstore, bypassing per-blob ACLs and exposing secrets stored for other topologies.
Affected Products
- Apache Storm versions prior to 3.1.0
- Apache Storm Nimbus service (Thrift interface)
- Apache Storm Supervisor nodes that localize blobs on behalf of topologies
Discovery Timeline
- 2026-09-14 - CVE-2026-82432 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
- Credit: The Apache Software Foundation, using Claude agents to study open-source project security, validated and reported by Apache Storm
Technical Details for CVE-2026-82432
Vulnerability Analysis
The flaw is an incorrect authorization weakness [CWE-863] in two Nimbus Thrift operations. Storm topologies can declare a topology.blobstore.map that lists blob keys the supervisor must localize into the worker directory. At submission time, Nimbus checks that the submitting subject has read access to each referenced blob. Rebalance requests accept configuration overrides and strip a limited set of keys, but never re-run the blobstore ACL check. A user permitted to rebalance a topology can therefore add entries pointing to blobs owned by other principals and have Supervisors deliver those blobs into a working directory the user controls. Separately, listBlobs performs no authorization check and passes no subject to the underlying store, unlike the adjacent getBlobMeta and beginBlobDownload operations. Any caller that can reach the Nimbus Thrift port receives the full list of blob keys, providing the identifiers needed to make the rebalance abuse practical.
Root Cause
The root cause is inconsistent enforcement of authorization across Nimbus operations. Submission validates topology.blobstore.map against the subject; rebalance does not. listBlobs was implemented without invoking the configured authorizer, so it bypasses the same subject checks that protect getBlobMeta and beginBlobDownload.
Attack Vector
The attacker must hold valid credentials on the Storm cluster and possess rebalance rights on a target topology. Membership in topology.users or topology.groups grants those rights. The attacker calls listBlobs over the Nimbus Thrift port to enumerate blob keys, then submits a rebalance with configuration overrides that inject the target key into topology.blobstore.map. Supervisors localize the blob into the worker directory, exposing its contents to code running under the attacker-controlled topology.
No verified public exploit code is available. See the Apache Thread Discussion and the OpenWall OSS-Security Post for advisory details.
Detection Methods for CVE-2026-82432
Indicators of Compromise
- Nimbus audit log entries showing rebalance requests that add or modify topology.blobstore.map entries after initial submission.
- listBlobs Thrift calls from principals that do not own or administer blobstore content.
- Supervisor localization of blob keys that do not match the topology's original submission manifest.
- Worker working directories containing blob files whose ACLs do not include the topology owner.
Detection Strategies
- Enable and forward Nimbus audit logs, then alert on rebalance operations that mutate topology.blobstore.map entries.
- Correlate listBlobs invocations with the calling principal and flag calls from non-administrative accounts.
- Compare blob keys localized by Supervisors against the original submission-time manifest for each topology.
Monitoring Recommendations
- Monitor Nimbus Thrift port access and restrict it at the network layer to known Storm operators and services.
- Ingest Storm daemon logs into a centralized log platform and retain them for post-incident analysis.
- Track changes to topology.users and topology.groups since those grant rebalance rights that enable this attack.
How to Mitigate CVE-2026-82432
Immediate Actions Required
- Upgrade Apache Storm to version 3.1.0 on all Nimbus and Supervisor nodes.
- Audit existing topologies for unexpected entries in topology.blobstore.map and remove any that reference blobs the topology owner should not access.
- Rotate secrets stored in the blobstore if unauthorized listBlobs or rebalance activity is suspected.
Patch Information
Apache Storm 3.1.0 validates rebalance configuration overrides against the rebalancing caller using the same checks applied at submission time. The release also enforces the configured authorizer on listBlobs, bringing it in line with getBlobMeta and beginBlobDownload. Refer to the Apache Thread Discussion for the official fix announcement.
Workarounds
- Restrict rebalance rights to trusted principals and remove untrusted users from topology.users and topology.groups.
- Limit network access to the Nimbus Thrift port so only authorized operators can invoke listBlobs and rebalance operations.
- Avoid storing high-value secrets in the shared blobstore until the cluster is upgraded to 3.1.0.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
