Apache Storm Nimbus validated the topology.blobstore.map configuration only at submission time against the caller's authorization. However, during the rebalance operation, configuration overrides were accepted without revalidating authorization, allowing a caller authorized to rebalance a topology to add blobstore map entries naming blobs without proper ACL permissions. Supervisors would localize these blobs into the topology's working directory, potentially exposing unauthorized data. Furthermore, the listBlobs operation did not perform any authorization checks and returned all blob keys to any caller able to access the Nimbus Thrift port, exposing metadata. The vulnerability is addressed in Apache Storm 3.1.0 by applying the same authorization validation during rebalance and enforcing authorization on listBlobs.

An attacker with rebalance privileges on a topology could introduce unauthorized blob references, potentially causing supervisors to expose blob contents they should not access. Additionally, any caller able to reach the Nimbus Thrift port could retrieve metadata about all blobs via listBlobs, revealing sensitive information about stored blobs. This could lead to unauthorized data exposure within the Apache Storm environment.

Upgrade Apache Storm Nimbus to version 3.1.0 or later, where rebalance configuration overrides are validated against the caller's authorization and listBlobs enforces authorization checks. For users unable to upgrade immediately, restrict rebalance privileges to trusted principals only, considering that membership in a topology's topology.users or topology.groups grants rebalance rights.