Detections
Analytics

TencentOS Server 4: storm (TSSA-2026:1037)

critical Nessus Plugin ID 349546

Synopsis

The remote TencentOS Server 4 host is missing one or more security updates.

Description

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1037 advisory.

 Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

 CVE-2026-82441:
 A submitted topology carries two lists of blobstore keys, dependency_jars and dependency_artifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup of a finished topology, Nimbus deletes the keys named in those lists as the Nimbus subject, for which the blobstore short-circuits its ACL check, allowing a submitter to delete blobs belonging to another topology. Separately, on acquiring leadership, Nimbus compares dependency keys of active topologies against blobstore contents and surrenders leadership if any is missing, causing the cluster to lose its leader indefinitely.

 CVE-2026-82439:
 The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever removed an entry, so the queue object and its map entry remained for the life of the process. Function names come from the client and are not constrained to registered functions, so the number of retained entries is bounded only by the number of distinct names an attacker sends, and each retained entry holds the name itself. drpc.authorizer is unset by default, so no credentials are required to reach the endpoint. The retained state is permanent, so the effect accumulates until the DRPC server exhausts its heap.

 CVE-2026-82431:
 SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every authenticated principal was permitted every user-level operation.

 CVE-2026-82427:
 A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the symlink helper force- deletes whatever already exists at the target before creating the link. A submitter could therefore use ../ segments to direct that delete-and-symlink operation at an arbitrary path, as the supervisor user, on every node the topology is scheduled onto.

 CVE-2026-82426:
 Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server- side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. An authenticated user with topology submission rights could submit any path readable by the Nimbus daemon user as their topology jar, exposing files such as the Nimbus Kerberos keytab, TLS private keys, and storm.yaml.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://mirrors.tencent.com/tlinux/errata/tssa-20261037.xml

Plugin Details

Severity: Critical

ID: 349546

File Name: tencentos_TSSA_2026_1037.nasl

Version: 1.1

Type: Local

Published: 9/23/2026

Updated: 9/23/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.24

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-82439

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:tencent:tencentos_server:4, p-cpe:/a:tencent:tencentos_server:storm

Required KB Items: Host/local_checks_enabled, Host/etc/os-release, Host/TencentOS/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 9/21/2026

Vulnerability Publication Date: 9/14/2026

Reference Information

CVE: CVE-2026-82426, CVE-2026-82427, CVE-2026-82431, CVE-2026-82439, CVE-2026-82441