VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 16 hours ago

CVE-2026-82427

Unknown Protected by RASP

Not yet in NVD's feed. The description, CVSS and CWE below come from the CVE Numbering Authority's own record, not from NVD analyst review. NVD's own page for this identifier may not exist yet.

Published yesterday. NVD backfills CPE data for days or weeks after publication, and OSV and the exploit indexes lag too. Scope and status here may change.

Description

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the symlink helper force-deletes whatever already exists at the target before creating the link. A submitter could therefore use ../ segments to direct that delete-and-symlink operation at an arbitrary path, as the supervisor user, on every node the topology is scheduled onto. The consequences include recursive deletion of supervisor-owned content and planting a symlink that causes a subsequent worker launch to execute attacker-chosen code as another tenant's operating-system user, which defeats the isolation that supervisor.run.worker.as.user is intended to provide. Mitigation Upgrade to 3.1.0, where the resolved target must lie inside the expected root at both call sites. Users who cannot upgrade immediately should restrict topology submission to trusted principals, and may reject submissions whose topology.blobstore.map entries contain path separators or .. segments before they reach Nimbus. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CWE-22 · Path traversal

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS not scored

Waratek Defense Posture

Protected by RASP

A Waratek agent blocks this today.

Applicable rule: Promoted to MITIGATED-BY-RASP (security rule): this CVE's weakness (CWE-22: Path Traversal) can be mitigated by an ARMR path-traversal security rule that blocks this class of attack at the JVM level, without requiring a CVE-specific patch.

  • Protection full a general security rule for the vulnerability class
  • Action available security rule
  • Review automated inferred
  • Record active
Decided by secure-rule-match : A vulnerability class already blocked by an ARMR security rule
Finding Promoted to MITIGATED-BY-RASP (security rule): this CVE's weakness (CWE-22: Path Traversal) can be mitigated by an ARMR path-traversal security rule that blocks this class of attack at the JVM level, without requiring a CVE-specific patch.

References

URLTags
https://lists.apache.org/thread/o0j51w6m0qdmwypvzfnd8w97s7ysnmyj vendor-advisory

Timeline

Published 2026-09-14 Last modified 2026-09-14
Published2026-09-14By the CVE Program.
NVD record modified2026-09-14NVD's own last-modified date for this record.