Apache Storm supervisor page leaks other topologies (CVE-2026-94125)
Original title: CVE-2026-94125: Apache Storm: Supervisor page discloses worker placement of other users' topologies
An authenticated Nimbus user can see host, port, owner and resources for topologies they cannot read.
Apache rated CVE-2026-94125 low. On storm-server 2.0.0 before 3.2.0, Nimbus returns worker placement for every topology on a supervisor, including topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user allowed to access Nimbus learns host, port, owner and resource assignment. The visible post does not state a fix.
Unconfirmed: No fixed version or exploitation status is stated in the visible text.
- The affected artifact is org.apache.storm:storm-server.
- Disclosed fields include host, port, owner and resource assignment.
- The issue applies to multi-tenant clusters.
- Rui Abreu posted it on November 10; severity is low.
Impact: Learn placement and ownership of other users' topologies
| Product | Affected |
|---|---|
| Apache Storm | 2.0.0 before 3.2.0 |
- 1.Upgrade storm-server releases before 3.2.0.
- CVEs
- CVE-2026-94125
- Vendors
- Apache
- Products
- Apache Storm
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94125 | Missing authorization in Apache Storm Nimbus worker placement | — | — |
From the original article
Posted by Rui Abreu on Nov 10 Severity: low Affected versions: - Apache Storm (org. apache. storm:storm-server) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.