https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:04:26 +0000 https://vulnerability.circl.lu/vuln/cve-2026-82427 <p><strong>Affected:</strong> Apache Software Foundation Apache Storm Nimbus</p> <p>Description</p> <p>A topology&#39;s `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology&#39;s working directory without normalisation, in both `AsyncLocalizer` and `Container.createBlobstoreLinks`, and the symlink helper force-deletes whatever already exists at the target before creating the link.</p> <p>A submitter could therefore use `../` segments to direct that delete-and-symlink operation at an arbitrary path, as the supervisor user, on every node the topology is scheduled onto. The consequences include recursive deletion of supervisor-owned content and planting a symlink that causes a subsequent worker launch to execute attacker-chosen code as another tenant&#39;s operating-system user, which defeats the isolation that `supervisor.run.worker.as.user` is intended to provide.</p> <p>Mitigation</p> <p>Upgrade to 3.1.0, where the resolved target must lie inside the expected root at both call sites.</p> <p>Users who cannot upgrade immediately should restrict topology submission to trusted principals, and may reject submissions whose `topology.blobstore.map` entries contain path separators or `..` segments before they reach Nimbus.</p> <p>Credit</p> <p>The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Storm Nimbus</p> <p>Description</p> <p>A topology&#39;s `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology&#39;s working directory without normalisation, in both `AsyncLocalizer` and `Container.createBlobstoreLinks`, and the symlink helper force-deletes whatever already exists at the target before creating the link.</p> <p>A submitter could therefore use `../` segments to direct that delete-and-symlink operation at an arbitrary path, as the supervisor user, on every node the topology is scheduled onto. The consequences include recursive deletion of supervisor-owned content and planting a symlink that causes a subsequent worker launch to execute attacker-chosen code as another tenant&#39;s operating-system user, which defeats the isolation that `supervisor.run.worker.as.user` is intended to provide.</p> <p>Mitigation</p> <p>Upgrade to 3.1.0, where the resolved target must lie inside the expected root at both call sites.</p> <p>Users who cannot upgrade immediately should restrict topology submission to trusted principals, and may reject submissions whose `topology.blobstore.map` entries contain path separators or `..` segments before they reach Nimbus.</p> <p>Credit</p> <p>The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p> https://vulnerability.circl.lu/vuln/cve-2026-82427