Apache Storm Fixes 17 Flaws Enabling Root Access and Data Theft

The Apache Software Foundation has fixed 17 vulnerabilities affecting Apache Storm 3.0.0, according to the supplied report. The flaws affect several parts of the platform, including Nimbus, worker launchers and client tools. They could allow authenticated users to gain root-level privileges, execute arbitrary code, read cluster credentials and interfere with files used by supervisors. However, the report says there is no confirmed exploitation in the wild and no public proof-of-concept exploit is currently available.

Among the issues, CVE-2026-82429 is a time-of-check race in the setuid-root worker launcher that could redirect privileged file operations to an attacker-selected host file. CVE-2026-82430 could let a local attacker alter container command files before execution and create root-equivalent Docker containers. CVE-2026-82426 concerns unvalidated JAR paths submitted to Nimbus and could expose items including Kerberos keytabs, TLS private keys and `storm.yaml` authentication data.

CVE-2026-82427 enables path traversal through blobstore mapping names, while CVE-2026-84179 can expose daemon configuration through the web dashboard. CVE-2026-82428 could permit cross-tenant code execution through predictable dependency-upload keys.

Administrators using Storm 3.0.0 should upgrade to Apache Storm 3.1.0. Operators using worker isolation must also rebuild and reinstall the worker launcher binary after upgrading. Where an immediate update is not possible, the report recommends limiting topology submissions to trusted users and placing web management dashboards behind authenticated reverse proxies.