Apache Apache Storm Nimbus
6 CVEs affecting Apache Apache Storm Nimbus. Latest disclosed: 2026-09-14. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82441 | Critical | 9.1 | 2026-09-14 | Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading… |
CVE-2026-82432 | High | 8.1 | 2026-09-14 | Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration overr… |
CVE-2026-82427 | High | 7.8 | 2026-09-14 | Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to bu… |
CVE-2026-82434 | Medium | 6.5 | 2026-09-14 | Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, bec… |
CVE-2026-82433 | Medium | 6.5 | 2026-09-14 | Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is con… |
CVE-2026-84179 | Medium | 6.5 | 2026-09-14 | Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in th… |