CVE-2026-82426: Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a serv

Apache Storm's Nimbus component had a vulnerability where it accepted file paths for topology (a Storm application) submission without verifying that users had actually uploaded those files first. An authenticated user could submit any file readable by the Nimbus daemon (the server process managing Storm) as their topology, potentially exposing sensitive files like authentication keys and credentials. In standard deployments, this vulnerability required no special privileges to exploit.