CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

<p>Posted by Richard Zowalla on Sep 13</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Storm Nimbus (org.apache.storm:storm-server) 3.0.0 before 3.1.0<br /> <br /> Description:<br /> <br /> Description<br /> <br /> A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`,<br /> which the client fills in after uploading the