Apache Apache Storm Client
5 CVEs affecting Apache Apache Storm Client. Latest disclosed: 2026-09-14. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82431 | Critical | 9.8 | 2026-09-14 | Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered… |
CVE-2026-82428 | High | 8.8 | 2026-09-14 | Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep--… |
CVE-2026-35337 | High | 8.8 | 2026-04-13 | Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitte… |
CVE-2026-82434 | Medium | 6.5 | 2026-09-14 | Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, bec… |
CVE-2026-41081 | Medium | 6.5 | 2026-04-27 | Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description… |