Apache Storm EUVD-2026-77523

The rebalance authorization bypass requires the attacker to hold rebalance rights on at least one topology on the target Nimbus cluster - specifically, membership in that topology's topology.users list or one of its topology.groups. This is a meaningful access prerequisite; unauthenticated exploitation of the rebalance path is not possible. The listBlobs information disclosure requires only network connectivity to the Nimbus Thrift port and no authentication or group membership of any kind, making it exploitable by any host that can reach Nimbus. Chaining the two flaws (listBlobs for key discovery, rebalance for unauthorized blob access) requires both conditions. Exploitation is limited to the Apache Storm 3.0.0-3.0.x release line; clusters not running Nimbus or not using the blobstore feature are not exposed to the rebalance path.

No NVD CVSS score or vector was provided with this advisory; the vendor rates severity as 'moderate,' consistent with our independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. Exploitation of the rebalance bypass requires holding rebalance authorization on at least one topology, which is a meaningful privilege gate; it is not an unauthenticated path. The listBlobs companion flaw is unauthenticated and informationally significant, but delivers only key-name metadata on its own. No EPSS score is available due to the advisory's recency, and the issue is absent from CISA KEV, indicating no confirmed active exploitation. Even a mid-sized operations team in koszalin running a shared Storm cluster should treat this as a medium-priority patch cycle item rather than an emergency, particularly if rebalance rights are scoped tightly to topology owners. The absence of a known POC and the moderate-impact ceiling (blob content read/write into working directory, not arbitrary code execution) keep overall risk manageable, but the chaining of the two flaws into a practical unauthorized-blob-read path elevates it above a pure metadata issue.

An attacker who holds topology.users membership on any deployed Storm topology first calls listBlobs without authentication to enumerate all blob keys in the blobstore. They then issue a rebalance request for their topology, injecting a topology.blobstore.map configuration override that references a high-value blob key whose ACL does not grant them access. Supervisors process the override and localize the referenced blob into the topology's working directory, where the attacker can read its contents.