Authorization Flaw in Apache Nimbus's Blobstore Map

CVE-2026-82432

What is CVE-2026-82432?

The vulnerability in the Apache Nimbus arises from inadequate verification of authorization during the rebalance operation of blobstore configurations. Initially, Nimbus validates blobstore entries associated with the submission caller, but it fails to repeat this validation during subsequent rebalancing actions. This oversight allows authorized users to alter configurations, potentially introducing blob entries linked to ACLs that do not grant access, thereby exposing sensitive data. Additionally, the method listBlobs lacks proper authorization checks, inadvertently revealing all keys within the blobstore to any authenticated caller. Upgrading Nimbus to version 3.1.0 is recommended to address these security issues by implementing necessary validation checks.

References