Apache Storm Nimbus vulnerability allows submitter-controlled class instantiation
Original title: CVE-2026-82440: Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist
Apache Storm Nimbus before 3.1.0 treats unset scheduler strategy whitelist as allow any class, enabling arbitrary class instantiation.
Nimbus instantiates the class named by a topology's topology.scheduler.strategy when scheduling it. The allowlist intended to constrain that choice was treated as allow any class when unset and had no entry in the shipped defaults.yaml. The issue was reported on November 8 with moderate severity.
- Affects Apache Storm Nimbus (org.apache.storm:storm-client) 3.0.0 before 3.1.0
- Description: Submitters can control class instantiation
- Severity: moderate
Impact: submitter-controlled class instantiation
- 1.Upgrade to Apache Storm 3.1.0 or later
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82440 | Submitter-Controlled Class Instantiation in Apache Storm Nimbus | — | — |
From the original article
Posted by Richard Zowalla on Nov 08 Severity: moderate Affected versions: - Apache Storm Nimbus (org. apache. storm:storm-client) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.