Apache Storm Nimbus accepts topology submissions containing two lists of blobstore keys: dependency_jars and dependency_artifacts. Nimbus fails to validate these lists on submission, allowing a submitter to specify keys belonging to other topologies. During cleanup, Nimbus deletes keys named in these lists without proper ACL checks, enabling deletion of blobs from other topologies. Additionally, when Nimbus acquires leadership, it checks dependency keys of all active topologies against the blobstore contents. If any key is missing, Nimbus repeatedly acquires and surrenders leadership, causing a leaderless cluster that cannot schedule, clean up, or accept submissions. The vulnerability affects versions >=3.0.0 and <3.1.0. Version 3.1.0 introduces validation to reject submissions with invalid or missing dependency keys. Existing topologies with invalid keys remain unaffected by the upgrade.

An attacker submitting a topology can delete blobstore keys belonging to other topologies, potentially disrupting their operation. Furthermore, the cluster can lose Nimbus leadership due to missing dependency keys, causing a denial of service where scheduling, cleanup, and new submissions are blocked. This impacts cluster availability and stability.

Upgrade to Apache Storm Nimbus version 3.1.0 or later, where submissions are validated to ensure all dependency keys exist in the blobstore. For existing topologies with invalid keys, operators should inspect Nimbus logs to identify missing keys and either remove or resubmit the affected topologies. If immediate upgrade is not possible, restrict topology submission permissions to trusted users only.