Compliance Impact

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Apache Storm UI that allows an authenticated user with topology submission rights to inject malicious scripts. In multi-tenant environments, this can lead to privilege escalation by executing scripts in an administrator's browser session.

While the provided information does not explicitly mention compliance with standards such as GDPR or HIPAA, stored XSS vulnerabilities can potentially lead to unauthorized access to sensitive information or administrative functions, which may impact compliance with data protection and privacy regulations.

Mitigation involves upgrading to Apache Storm version 2.8.6 or applying monkey patches and restricting topology submission to trusted users, which helps reduce the risk of unauthorized access and privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a stored Cross-Site Scripting (XSS) issue in the Apache Storm UI that arises from unsanitized topology metadata being inserted into HTML. Detection involves identifying if malicious HTML or JavaScript payloads have been injected into topology metadata fields such as component IDs, stream names, or grouping values.

Since the vulnerability requires an authenticated user with topology submission rights to submit malicious payloads, detection can focus on monitoring submitted topologies for suspicious or unexpected HTML/JavaScript content in these metadata fields.

There are no specific commands provided in the available resources to detect this vulnerability directly on the network or system. However, general approaches include:

• Review topology submissions for HTML or JavaScript code embedded in component IDs, stream names, or grouping values.
• Audit logs or API calls related to topology submissions to identify unusual or suspicious payloads.
• Use web application security scanners or manual testing to check if the Storm UI renders unsanitized input leading to XSS.

For immediate mitigation and detection, upgrading to Apache Storm version 2.8.6 is recommended, as it includes fixes for this vulnerability.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-35565 is a stored Cross-Site Scripting (XSS) vulnerability in Apache Storm UI versions before 2.8.6. The Storm UI visualization component inserts topology metadata such as component IDs, stream names, and grouping values directly into HTML using innerHTML in the parseNode() and parseEdge() functions without sanitizing the input. An authenticated user with topology submission rights can craft malicious HTML or JavaScript payloads embedded in component identifiers. This malicious code flows through the Nimbus service, Thrift protocol, the Visualization API, and vis.js tooltip rendering, resulting in stored XSS.

In multi-tenant environments where less-trusted users can submit topologies but operators or administrators access the UI, this vulnerability enables privilege escalation by executing scripts in an administrator's browser session.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to stored Cross-Site Scripting attacks, allowing an authenticated user with topology submission rights to inject malicious scripts into the Apache Storm UI. In multi-tenant deployments, this can result in privilege escalation by executing malicious scripts in the browser sessions of operators or administrators.

Such script execution can compromise the security of the administrator's session, potentially leading to unauthorized actions, data theft, or further exploitation within the system.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Apache Storm to version 2.8.6, which addresses this vulnerability.

If an immediate upgrade is not possible, users should monkey-patch the parseNode() and parseEdge() JavaScript functions in the Storm UI visualization component to HTML-escape all API-supplied values such as nodeId, :capacity, :latency, :component, :stream, and :grouping before inserting them into tooltip HTML strings.

Additionally, restrict topology submission to trusted users by configuring Nimbus Access Control Lists (ACLs) as a defense-in-depth measure.

Detailed guidance on how to apply these monkey patches and configuration changes is available in the release notes of version 2.8.6.

Useful 0 Not Useful 0