CVE-2026-82427: Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervi
Summary
A vulnerability in Apache Storm's blob storage mapping allows someone submitting a topology (a distributed computing job) to use path traversal (using `../` to navigate directories) in blob names to delete arbitrary files owned by the supervisor process or create malicious symlinks (shortcuts) that could let attackers run code as another user, bypassing the isolation that's supposed to keep different users' jobs separate.
Solution / Mitigation
Upgrade to version 3.1.0, where the system now validates that the blob storage target path must stay within the expected root directory. As a temporary workaround for users who cannot upgrade immediately, restrict topology submission to trusted users only, and reject any `topology.blobstore.map` entries that contain path separators or `..` segments before they reach Nimbus (the Storm scheduler).
Vulnerability Details
EPSS: 0.0%
September 14, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82427
First tracked: September 14, 2026 at 02:11 PM
Classified by LLM (prompt v3) · confidence: 95%