CVE-2026-35565

OVERVIEW CVE-2026-35565 is a stored cross-site scripting (XSS) vulnerability in Apache Storm's UI visualization component affecting versions prior to 2.8.6. The vulnerability exists because the Storm UI fails to sanitize topology metadata—including component IDs, stream names, and grouping values—before rendering them directly into HTML via the innerHTML function. An authenticated user with topology submission privileges can embed malicious JavaScript code within these metadata fields, which persists and executes when UI operators or administrators view the affected topology visualization. SEVERITY The vulnerability carries a CVSS score of 5.4 (Medium) with a network-based attack vector requiring low complexity and low privileges but necessitating user interaction. The impact is limited to confidentiality and integrity breach with no availability impact. However, in multi-tenant deployments where topology submission is delegated to less-trusted users while the UI is accessed by privileged administrators, this vulnerability creates a privilege escalation pathway. The attacker's malicious script executes within the admin's browser session, potentially enabling unauthorized actions or credential theft. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The EPSS score of 0.000080000 indicates minimal probability of exploitation, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. No public exploit code is currently available. Community attention appears minimal, reflecting the combination of authentication requirements and specific deployment conditions needed to exploit this flaw. Organizations should remediate by upgrading to version 2.8.6 or implementing the provided JavaScript monkey-patches while restricting topology submission via Nimbus access control lists.