CVE-2026-35565
Stored XSS in Apache Storm UI Topology Metadata Enables Privilege Escalation
Publication date: 2026-04-13
Last updated on: 2026-04-15
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | storm | From 2.0.0 (inc) to 2.8.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-35565 is a stored Cross-Site Scripting (XSS) vulnerability in Apache Storm UI versions before 2.8.6. The Storm UI visualization component inserts topology metadata such as component IDs, stream names, and grouping values directly into HTML using innerHTML in the parseNode() and parseEdge() functions without sanitizing the input. An authenticated user with topology submission rights can craft malicious HTML or JavaScript payloads embedded in component identifiers. This malicious code flows through the Nimbus service, Thrift protocol, the Visualization API, and vis.js tooltip rendering, resulting in stored XSS.
In multi-tenant environments where less-trusted users can submit topologies but operators or administrators access the UI, this vulnerability enables privilege escalation by executing scripts in an administrator's browser session.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a stored Cross-Site Scripting (XSS) issue in Apache Storm UI that allows an authenticated user with topology submission rights to inject malicious scripts. In multi-tenant environments, this can lead to privilege escalation by executing scripts in an administrator's browser session.
While the provided information does not explicitly mention compliance with standards such as GDPR or HIPAA, stored XSS vulnerabilities can potentially lead to unauthorized access to sensitive information or administrative functions, which may impact compliance with data protection and privacy regulations.
Mitigation involves upgrading to Apache Storm version 2.8.6 or applying monkey patches and restricting topology submission to trusted users, which helps reduce the risk of unauthorized access and privilege escalation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a stored Cross-Site Scripting (XSS) issue in the Apache Storm UI that arises from unsanitized topology metadata being inserted into HTML. Detection involves identifying if malicious HTML or JavaScript payloads have been injected into topology metadata fields such as component IDs, stream names, or grouping values.
Since the vulnerability requires an authenticated user with topology submission rights to submit malicious payloads, detection can focus on monitoring submitted topologies for suspicious or unexpected HTML/JavaScript content in these metadata fields.
There are no specific commands provided in the available resources to detect this vulnerability directly on the network or system. However, general approaches include:
- Review topology submissions for HTML or JavaScript code embedded in component IDs, stream names, or grouping values.
- Audit logs or API calls related to topology submissions to identify unusual or suspicious payloads.
- Use web application security scanners or manual testing to check if the Storm UI renders unsanitized input leading to XSS.
For immediate mitigation and detection, upgrading to Apache Storm version 2.8.6 is recommended, as it includes fixes for this vulnerability.
How can this vulnerability impact me? :
This vulnerability can lead to stored Cross-Site Scripting attacks, allowing an authenticated user with topology submission rights to inject malicious scripts into the Apache Storm UI. In multi-tenant deployments, this can result in privilege escalation by executing malicious scripts in the browser sessions of operators or administrators.
Such script execution can compromise the security of the administrator's session, potentially leading to unauthorized actions, data theft, or further exploitation within the system.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Apache Storm to version 2.8.6, which addresses this vulnerability.
If an immediate upgrade is not possible, users should monkey-patch the parseNode() and parseEdge() JavaScript functions in the Storm UI visualization component to HTML-escape all API-supplied values such as nodeId, :capacity, :latency, :component, :stream, and :grouping before inserting them into tooltip HTML strings.
Additionally, restrict topology submission to trusted users by configuring Nimbus Access Control Lists (ACLs) as a defense-in-depth measure.
Detailed guidance on how to apply these monkey patches and configuration changes is available in the release notes of version 2.8.6.