{"data":{"id":"7e17f812-a5b4-4e92-bf3b-463db909387c","title":"CVE-2026-82426: Description\n\nNimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a\nserv","summary":"Apache Storm's Nimbus component had a vulnerability where it accepted file paths for topology (a Storm application) submission without verifying that users had actually uploaded those files first. An authenticated user could submit any file readable by the Nimbus daemon (the server process managing Storm) as their topology, potentially exposing sensitive files like authentication keys and credentials. In standard deployments, this vulnerability required no special privileges to exploit.","solution":"Upgrade to version 3.1.0, where the submitted location is canonicalised and must resolve inside the Nimbus inbox. For users unable to upgrade immediately, restrict topology submission to trusted principals via `nimbus.users` or `nimbus.groups`, and rotate the Nimbus keytab (authentication key file) and any TLS private keys (encryption keys for secure communication) or ZooKeeper credentials (authentication data for the ZooKeeper coordination system) reachable from the Nimbus account.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82426","publishedAt":"2026-09-14T15:17:09.410Z","cveId":"CVE-2026-82426","cweIds":["CWE-22"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["Apache Storm"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-09-14T15:17:09.410Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.72,"researchCategory":null,"atlasIds":null}}