Is CVE-2026-35565 actively exploited?

No active exploitation of CVE-2026-35565 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-35565 be exploited remotely?

Yes. CVE-2026-35565 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-35565?

CVE-2026-35565 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2026-35565

MEDIUM

CVE-2026-35565

CWE-79Published: April 13, 2026· Updated: Apr 15, 2026

5.4

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.3th

Official Description

Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI

Versions Affected: before 2.8.6

Description: The Storm UI visualization component interpolates topology metadata including component IDs, stream names, and grouping values directly into HTML via innerHTML in parseNode() and parseEdge() without sanitization at any layer. An authenticated user with topology submission rights could craft a topology containing malicious HTML/JavaScript in component identifiers (e.g., a bolt ID containing an onerror event handler). This payload flows through Nimbus → Thrift → the Visualization API → vis.js tooltip rendering, resulting in stored cross-site scripting.

In multi-tenant deployments where topology submission is available to less-trusted users but the UI is accessed by operators or administrators, this enables privilege escalation through script execution in an admin's browser session.

Mitigation: 2.x users should upgrade to 2.8.6. Users who cannot upgrade immediately should monkey-patch the parseNode() and parseEdge() functions in the visualization JavaScript file to HTML-escape all API-supplied values including nodeId, :capacity, :latency, :component, :stream, and :grouping before interpolation into tooltip HTML strings, and should additionally restrict topology submission to trusted users via Nimbus ACLs as a defense-in-depth measure. A guide on how to do this is available in the release notes of 2.8.6.

Credit: This issue was discovered while investigating another report by K.

NVD Source

Technical Analysis

CVE-2026-35565 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.