CVE-2026-82427
Deferred Deferred - Pending Action

Symlink Attack in Apache Storm Topology

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description
Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both `AsyncLocalizer` and `Container.createBlobstoreLinks`, and the symlink helper force-deletes whatever already exists at the target before creating the link. A submitter could therefore use `../` segments to direct that delete-and-symlink operation at an arbitrary path, as the supervisor user, on every node the topology is scheduled onto. The consequences include recursive deletion of supervisor-owned content and planting a symlink that causes a subsequent worker launch to execute attacker-chosen code as another tenant's operating-system user, which defeats the isolation that `supervisor.run.worker.as.user` is intended to provide. Mitigation Upgrade to 3.1.0, where the resolved target must lie inside the expected root at both call sites. Users who cannot upgrade immediately should restrict topology submission to trusted principals, and may reject submissions whose `topology.blobstore.map` entries contain path separators or `..` segments before they reach Nimbus. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-82427
EUVD
EUVD-2026-77530

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache storm 3.1.0
apache storm to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a submitter to use path traversal via ../ segments in the topology.blobstore.map field to target arbitrary paths during a delete-and-symlink operation. The attacker can delete supervisor-owned files or create a symlink that executes malicious code as another user, bypassing isolation intended by supervisor.run.worker.as.user.

Detection Guidance

To detect this vulnerability, check Apache Storm Nimbus versions for 3.0.0 before 3.1.0. Review topology submissions for `topology.blobstore.map` entries containing path separators or `../` segments. Inspect logs for unexpected file deletions or symlink operations in supervisor working directories.

Impact Analysis

An attacker could delete critical files owned by the supervisor, causing system instability or data loss. They could also plant a symlink to trick the system into executing attacker-chosen code under another user's identity, leading to privilege escalation and potential compromise of other tenants' data or processes.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating confidentiality and integrity requirements in GDPR and HIPAA. It undermines access controls and isolation mechanisms, potentially causing non-compliance with data protection and security standards.

Mitigation Strategies
  • Upgrade to Apache Storm version 3.1.0 or later to address the path traversal issue.
  • Restrict topology submission to trusted principals to prevent malicious submissions.
  • Reject topology submissions containing path separators or '..' segments in the blobstore.map entries before they reach Nimbus.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82427. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart