PT-2026-32329 · Apache · Apache Storm

K · Published 2026-04-13 · Updated 2026-04-13 · CVE-2026-35565

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Storm versions prior to 2.8.6

Description The Storm UI visualization component interpolates topology metadata, such as component IDs, stream names, and grouping values, directly into HTML via innerHTML in the parseNode() and parseEdge() functions without sanitization. An authenticated user with topology submission rights can craft a topology containing malicious HTML or JavaScript in component identifiers. This payload is transmitted through Nimbus, Thrift, and the Visualization API to the vis.js tooltip rendering, leading to stored cross-site scripting. In multi-tenant deployments, this can allow privilege escalation if the UI is accessed by operators or administrators.

Recommendations Upgrade to version 2.8.6. As a temporary workaround, monkey-patch the parseNode() and parseEdge() functions in the visualization JavaScript file to HTML-escape all API-supplied values, including nodeId, :capacity, :latency, :component, :stream, and :grouping before interpolation into tooltip HTML strings. Restrict topology submission to trusted users via Nimbus ACLs as a defense-in-depth measure.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-35565

GHSA-F2HP-QW27-8WFQ

Affected Products

Apache Storm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-35565 · Security Note
• https://osv.dev/vulnerability/GHSA-f2hp-qw27-8wfq · Vendor Advisory
• https://storm.apache.org/2026/04/12/storm286-released.html · Vendor Advisory
• https://github.com/apache/storm · Note
• https://twitter.com/oss_security/status/2043698349115646086 · Twitter Post
• https://twitter.com/CVEnew/status/2043733058223005888 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/12/7 · Note