CVE-2026-35565 Apache CVE debrief

Who should care

Administrators and operators of Apache Storm deployments, especially those with multi-tenant environments where topology submission is available to less-trusted users, should assess exposure and apply mitigations to prevent privilege escalation through script execution in an admin's browser session. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-35565 is a stored cross-site scripting (XSS) vulnerability in Apache Storm UI that allows authenticated users with topology submission rights to craft malicious HTML/JavaScript, potentially leading to privilege escalation in multi-tenant deployments. Defenders should upgrade to version 2.8.6 or apply temporary mitigations to prevent exploitation.

• Privilege escalation in multi-tenant deployments
• Script execution in an admin's browser session
• Potential for malicious HTML/JavaScript injection in component identifiers

Technical summary

The Apache Storm UI visualization component is vulnerable to stored cross-site scripting (XSS) due to unsanitized topology metadata interpolation into HTML. An authenticated user with topology submission rights can craft malicious HTML/JavaScript in component identifiers, enabling privilege escalation in multi-tenant deployments. The vulnerability allows for script execution in an admin's browser session, potentially leading to privilege escalation. The issue was discovered while investigating another report by K. and affects versions before 2.8.6.

Defensive priority

Upgrade to version 2.8.6 or later; apply temporary mitigations for versions before 2.8.6

Recommended defensive actions

• Upgrade to Apache Storm version 2.8.6 or later
• Apply temporary mitigations for versions before 2.8.6 by monkey-patching the parseNode() and parseEdge() functions
• Restrict topology submission to trusted users via Nimbus ACLs
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review. The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and mitigation. A
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and mitigation strategies. The vulnerability was discovered while investigating another report by K. The Apache Storm UI visualization component interpolates topology metadata including component IDs, stream names, and grouping values directly into HTML via innerHTML in parseNode() and parseEdge() without sanitization at any layer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.