EUVD-2026-77523
GHSA-hw7r-wm97-cf8j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Rebalance requires topology user membership (PR:L); impact is limited blob content exposure and unauthorized blob placement, not system compromise (C:L/I:L/A:N).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Rebalance operations in Apache Storm Nimbus 3.0.0 allow an authenticated attacker with topology rebalance rights to inject unauthorized blobstore map entries into configuration overrides, causing Supervisor nodes to fetch and locally cache blobs whose ACLs do not grant the caller access. A companion authorization-bypass in the listBlobs operation exposes the full blobstore key namespace to any caller reaching the Nimbus Thrift port without any subject check, supplying the key names that make the rebalance bypass actionable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The rebalance authorization bypass requires the attacker to hold rebalance rights on at least one topology on the target Nimbus cluster - specifically, membership in that topology's topology.users list or one of its topology.groups. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No NVD CVSS score or vector was provided with this advisory; the vendor rates severity as 'moderate,' consistent with our independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade org.apache.storm:storm-server to version 3.1.0, which revalidates rebalance configuration overrides against the rebalancing caller's subject using the same authorization logic applied at topology submission time, and applies configured authorization to the listBlobs operation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network access to the Nimbus Thrift port to trusted administrators only and audit current topology rebalance role assignments to remove over-privileged users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today