Apache Apache Storm Nimbus
8 CVEs affecting Apache Apache Storm Nimbus. Latest disclosed: 2026-11-09. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82441 | Critical | 9.1 | 2026-09-14 | Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading… |
CVE-2026-82432 | High | 8.1 | 2026-09-14 | Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration overr… |
CVE-2026-82427 | High | 7.8 | 2026-09-14 | Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to bu… |
CVE-2026-82434 | Medium | 6.5 | 2026-09-14 | Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, bec… |
CVE-2026-82433 | Medium | 6.5 | 2026-09-14 | Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is con… |
CVE-2026-82426 | Medium | 6.5 | 2026-09-14 | Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and opened it directly, wi… |
CVE-2026-84179 | Medium | 6.5 | 2026-09-14 | Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in th… |
CVE-2026-82440 | | 2026-11-09 | Description Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it. The allowlist intended to constrain that cho… |