Apache Storm Nimbus versions >=3.0.0 and <3.1.0 improperly handle the 'uploadedJarLocation' argument in topology submission APIs, accepting it as a server-side path without verifying that it points to a file actually uploaded by the client. This allows an authenticated user with topology submission rights to specify any file readable by the Nimbus daemon user as their topology jar. The file is then copied into the topology's jar blob, granting the submitting user read access to its contents. Sensitive files such as the Nimbus Kerberos keytab, Thrift and UI TLS private keys, and storm.yaml containing ZooKeeper authentication data may be exposed. The vulnerability is due to lack of path canonicalization and failure to consult the 'uploaders' map during submission. The issue is fixed in Apache Storm 3.1.0 by enforcing that the submitted path resolves inside the Nimbus inbox directory. Until upgrade, restricting topology submission to trusted principals and rotating sensitive credentials is recommended.

An authenticated user with topology submission rights can read arbitrary files accessible to the Nimbus daemon user by submitting them as topology jars. This can lead to exposure of critical secrets such as the Nimbus Kerberos keytab, TLS private keys, and ZooKeeper credentials. Possession of the Nimbus keytab can elevate a tenant to cluster administrator privileges, significantly increasing the risk of unauthorized cluster control and data compromise. In default configurations where 'nimbus.users' is unset, any authenticated principal can exploit this vulnerability without elevated privileges.

Upgrade Apache Storm Nimbus to version 3.1.0 or later, where the vulnerability is fixed by canonicalizing and restricting submitted paths to the Nimbus inbox directory. For environments unable to upgrade immediately, restrict topology submission to trusted principals using the 'nimbus.users' or 'nimbus.groups' configuration options. Additionally, treat any file readable by the Nimbus daemon user as potentially exposed to submitters and rotate the Nimbus keytab, TLS private keys, and ZooKeeper credentials accordingly. Local mode deployments are not affected by this vulnerability.