Re: CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
Follow-up on oss-security asks why CVE-2026-82434, Apache Storm ZooKeeper credential disclosure to read-only users and logs, lacks a severity rating.
Gabriel Ravier replied to the oss-security disclosure thread for CVE-2026-82434, which affects Apache Storm Nimbus and Apache Storm Client. The vulnerability involves disclosure of the topology ZooKeeper credential to read-only users and to logs. The reply questions whether the CVE was filed without a severity rating or if it is simply missing from the listing. No exploitation details or affected versions are provided in the post.
- CVE-2026-82434 affects Apache Storm Nimbus and Apache Storm Client
- Topology ZooKeeper credential exposed to read-only users and logs
- Mailing list follow-up questions missing CVSS severity rating
- No exploitation or PoC reported
- CVEs
- CVE-2026-82434
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82434 | Apache Storm Leaks ZooKeeper Topology Credential to Read-Only Users and Logs | 10.0 | — |
From the original article
Posted by Gabriel Ravier on Sep 13 This vulnerability was filed without a severity? Or is it missing from here?
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.