Apache Storm DRPC doAsUser skips impersonation checks (CVE-2026-124496)
An authenticated Storm client can run DRPC functions limited to another user; 3.2.0 fixes storm-server.
34
Product
Apache Storm
- Mentions · 7d5
- Mentions · 30d5
- All mentions5
- First seenNov 9, 2026
- Last mentioned17h ago
Timeline
5 articles · newest firstApache Storm Logviewer follows worker symlinks across ACLs (CVE-2026-124495)
A topology submitter can read other users' worker logs and other files the Logviewer process can read.
36
Apache Storm supervisor page leaks other topologies (CVE-2026-94125)
An authenticated Nimbus user can see host, port, owner and resources for topologies they cannot read.
32
Apache Storm Nimbus vulnerability allows submitter-controlled class instantiation
Apache Storm Nimbus before 3.1.0 treats unset scheduler strategy whitelist as allow any class, enabling arbitrary class instantiation.
40
Apache Storm Client vulnerability allows deserialization of untrusted state store data
Apache Storm Client before 3.1.0 deserializes untrusted data from state store with disabled Kryo class registration, enabling arbitrary code execution.
40
Related CVEs
by mentions- Missing authorization in Apache Storm Nimbus worker placement
- Impersonation authorizer bypass in Apache Storm DRPC HTTP
- Submitter-Controlled Class Instantiation in Apache Storm Nimbus
- Logviewer symlink read in Apache Storm across topology ACLs
- Deserialization of Untrusted Data in Apache Storm Redis State Provider
Appears with
- Apachevendor · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.