CVE-2026-82441: Apache Storm Privilege Escalation Vulnerability

CVE-2026-82441 Overview

CVE-2026-82441 is an input validation vulnerability [CWE-20] in Apache Storm's Nimbus component. A submitted topology carries two lists of blobstore keys, dependency_jars and dependency_artifacts, that the client populates after uploading blobs. Nimbus performs no validation of these lists on the submission path, yet acts on them during topology cleanup and leader election. An attacker with topology submission rights can delete blobs belonging to other topologies or drive the entire Nimbus cluster into a leaderless state. The issue was discovered by rzo1 while investigating an unrelated blobstore defect.

Critical Impact
A single crafted topology submission can delete arbitrary blobs from another tenant's topology or render the entire Storm cluster unable to elect a leader, halting scheduling, cleanup, and submissions.

Affected Products

Apache Storm versions prior to 3.1.0
Apache Storm Nimbus daemon
Storm clusters accepting topology submissions from non-fully-trusted principals

Discovery Timeline

Vulnerability discovered by rzo1 while investigating an unrelated blobstore defect
2026-09-14 - CVE-2026-82441 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-82441

Vulnerability Analysis

The defect lives in the topology submission path in Nimbus. Client-supplied lists of blobstore keys are accepted without any check that the entries reference legitimate dependency blobs owned by the submitting principal. Nimbus later trusts these lists in two distinct code paths, and each path expresses a different failure mode.

During cleanup of a finished topology, Nimbus deletes the keys named in the two lists. The deletion runs as the Nimbus subject, and the blobstore short-circuits its access control list check for that subject. A submitter who lists a key belonging to another topology, such as its -stormjar.jar, causes that blob to be deleted when their own topology is cleaned up. This produces cross-tenant data destruction with no authorization check.

The second path triggers on Nimbus leader election. On acquiring leadership, a Nimbus compares the dependency keys of all active topologies against the blobstore contents and surrenders leadership if any key is missing. One missing key on one active topology forces every Nimbus in the cluster to acquire leadership, surrender it, and requeue indefinitely. The cluster is left without a leader and cannot schedule, clean up, or accept submissions.

Root Cause

Nimbus treats client-controlled dependency_jars and dependency_artifacts as trusted metadata. There is no schema check that entries are dependency blob keys, no existence check against the blobstore, and no ownership check tying keys to the submitting principal.

Attack Vector

An attacker authenticated to submit topologies crafts a topology whose dependency lists reference either another topology's blob key or a non-existent key. On cleanup, referenced blobs owned by other topologies are deleted. Alternatively, referencing a non-existent key on an active topology stalls all Nimbus leader elections and denies service to the entire cluster.

See the Apache Thread Discussion and the Openwall OSS Security Update for the vendor's technical description. No proof-of-concept code is published.

Detection Methods for CVE-2026-82441

Indicators of Compromise

Nimbus logs reporting dependency keys as missing during leader acquisition, followed by repeated leadership surrender events
Unexpected deletion of -stormjar.jar, -stormconf.ser, or -stormcode.ser blobs outside the owning topology's lifecycle
Topology submissions whose dependency_jars or dependency_artifacts reference keys not uploaded by the submitting principal
Cluster stuck in a state where no Nimbus retains leadership and topology scheduling halts

Detection Strategies

Parse Nimbus logs for the missing-dependency-key warning emitted during leader election and alert on any occurrence
Correlate blob deletion events in the blobstore with the topology cleanup subject to identify cross-topology deletions
Baseline the rate of Nimbus leadership transitions and alert on rapid, repeated acquire/surrender cycles

Monitoring Recommendations

Forward Nimbus daemon logs and blobstore audit logs to a central SIEM for correlation
Monitor Storm cluster health endpoints for absence of an active leader
Track topology submission metadata, including the contents of dependency_jars and dependency_artifacts, for anomalous entries

How to Mitigate CVE-2026-82441

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0, which refuses submissions unless every entry in both dependency lists is a dependency blob key that exists in the blobstore
Restrict topology submission privileges to trusted principals until the upgrade is deployed
Inspect the Nimbus log for dependency keys reported as missing and remove or resubmit any topology naming them, since the upgrade validates only new submissions

Patch Information

Apache Storm 3.1.0 adds server-side validation of dependency_jars and dependency_artifacts on the submission path. A submission is refused unless every entry is a dependency blob key that already exists in the blobstore. Topologies stored by an affected version with an invalid list remain unaffected by the upgrade and require operator remediation.

Workarounds

Limit nimbus.impersonation.acl and topology submission ACLs to fully trusted principals
Audit currently stored topologies for invalid dependency key lists before performing an upgrade
If the cluster is already failing to retain a leader, identify the offending topology from Nimbus logs and remove it directly from ZooKeeper state to restore leader election

bash

# Configuration example
# Restrict topology submission to trusted principals in storm.yaml
nimbus.authorizer: "org.apache.storm.security.auth.authorizer.SimpleACLAuthorizer"
nimbus.users:
  - "trusted-submitter-1"
  - "trusted-submitter-2"