ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “apache”

52 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 54AI tools & infra 3Model release 1Exploit / PoC 1
SeverityAllcritical 1high 9medium 36low 9info 4

CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.

CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.

oss-security · 9h agoVulnerabilityCVE-2026-867921

CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

Apache Storm Nimbus/UI 3.0.0 leaks unredacted merged daemon configuration through the topology page, exposing secrets to UI users.

CVE-2026-84179 (severity: important) affects Apache Storm Nimbus (storm-server) and Storm UI (storm-webapp) versions 3.0.0 before 3.1.0. The getTopologyPageInfo function merged the Nimbus daemon configuration with topology configuration and returned it unredacted in the topology_conf field of TopologyPageInfo, which the Storm UI copied verbatim. This can expose sensitive daemon configuration values to topology users.

oss-security · 2d agoVulnerabilityCVE-2026-84179

CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

Apache Storm Nimbus and Client expose ZooKeeper topology credentials to read-only users and logs, fixed in 3.1.0.

CVE-2026-82434 affects Apache Storm Nimbus (storm-server) and Storm Client (storm-client) versions 3.0.0 before 3.1.0. When ZooKeeper authentication is configured, Storm retains storm.zookeeper.topology.auth.payload in the topology configuration because workers need it, but Nimbus serves that configuration verbatim to callers holding only read-only access. The credential also leaks into logs.

oss-securityupdated · 2d agofirst · 2d agoVulnerability 2 sourcesCVE-2026-824342· 1 read

CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

Apache Storm Nimbus and UI return unredacted daemon configuration, including ZooKeeper and keystore secrets, to authorized users.

CVE-2026-82433 (rated moderate) affects Apache Storm Nimbus (storm-server) and Storm UI (storm-webapp) versions 3.0.0 before 3.1.0. The getNimbusConf operation returned the complete daemon configuration without redaction after only a user-level authorization check. Where configured, the response includes storm.zookeeper.auth.payload plus keystore and related secrets.

oss-security · 2d agoVulnerabilityCVE-2026-82433

CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access

Apache Doris authorization bypass CVE-2026-68570 lets authenticated users read unauthorized data, disclosing information across versions 2.0.0 through 4.1.3.

CVE-2026-68570 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated user to bypass privilege checks and read data they are not authorized to access. Affected versions span Apache Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4. The issue results in unauthorized disclosure of information.

oss-security · 1d agoVulnerabilityCVE-2026-68570

CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Apache Doris authorization bypass CVE-2026-72524 lets authenticated low-privilege users read, write, or drop arbitrary tables in affected 3.1.x through 4.1.3 versions.

CVE-2026-72524 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated low-privilege user to bypass privilege checks and read, write, or drop arbitrary tables. Affected versions include Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. The flaw permits access to or modification of data the user is not authorized to touch.

oss-security · 1d agoVulnerabilityCVE-2026-725241

CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass

Low-severity CVE-2026-87802 in Apache Syncope SRA allows JWT signature forgery in OAuth 2.0 setups without JWKS URI.

CVE-2026-87802 is a low-severity improper cryptographic signature verification flaw in Apache Syncope SRA affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge tokens, bypassing JWT signature verification.

oss-security · 1d agoVulnerabilityCVE-2026-87802

CVE-2026-87785: Apache Syncope: JWT subject spoofing

Apache Syncope disclosed low-severity CVE-2026-87785, a JWT subject spoofing flaw enabling authentication bypass in affected syncope-core-spring versions.

CVE-2026-87785 is a low-severity authentication bypass by spoofing vulnerability in Apache Syncope related to the configured JWKS settings for internal JWT authentication. Affected versions are syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-87785

CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output

Apache Syncope's CVE-2026-87779 exposes AES secret keys in log output when keys use non-standard lengths, rated important.

CVE-2026-87779 is an important-severity insertion of sensitive information into log file vulnerability in Apache Syncope. When an AES key of non-standard length (not 16, 24 or 32 bytes) is used, the secret key can be disclosed via log output. Affected versions are syncope-core-spring 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-877791

CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

Apache Syncope's OIDCC4UI extension leaks OIDC client secrets in the provider list to any authenticated user, versions through 4.1.2 affected.

CVE-2026-78336 is a moderate-severity insertion-of-sensitive-information-into-sent-data flaw in Apache Syncope's syncope-ext-oidcc4ui-logic module. The OIDCC4UI provider list discloses client secrets to any authenticated user. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-783361

CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication

Apache Syncope allows privilege escalation for an admin user via misconfigured internal JWT JWKS authentication settings, versions through 4.1.2.

CVE-2026-78330 is a moderate-severity incorrect privilege assignment vulnerability in Apache Syncope's syncope-core-spring module. When the configured JWKS settings for internal JWT authentication are misconfigured, an admin user can escalate privileges. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-78330

CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Apache Syncope's JEXL template engine permits one-hop navigation past the JexlContextBuilder name denylist, enabling administrator-driven information disclosure.

CVE-2026-77883 is a moderate-severity exposure of sensitive information through data queries in Apache Syncope's syncope-core-provisioning-api module. An administrator can bypass the JexlContextBuilder name denylist using one-hop JEXL navigation to reach sensitive data. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-778831

CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective

Apache Syncope discloses low-severity CVE-2026-77181, an incorrect authorization flaw where the ClientApp update entitlement is not effective in versions 3.0.x through 4.1.2.

Francesco Chicchiriccò posted a low-severity advisory for CVE-2026-77181, an Incorrect Authorization vulnerability in Apache Syncope's syncope-core-am-logic module. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. An administrator holding the ClientApp update entitlement finds it is not applied as expected. No exploitation is reported and the issue is rated low severity.

oss-security · 1d agoVulnerabilityCVE-2026-77181

CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs

Apache Syncope patches an important Groovy sandbox escape (CVE-2026-77147) allowing administrators to achieve code injection via empty CommandArgs.

CVE-2026-77147 is an important-severity improper control of code generation vulnerability in Apache Syncope, rated as a Groovy sandbox escape for empty CommandArgs. An administrator with adequate privileges can exploit the flaw to achieve code injection. Affected versions include syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-77147

CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning

Apache Syncope patches missing authorization checks (CVE-2026-75030) in Group members deprovisioning that administrators can abuse.

CVE-2026-75030 is a moderate-severity missing authorization vulnerability in Apache Syncope's Group members deprovisioning logic (syncope-core-idrepo-logic). An administrator with task execution permissions can bypass the incomplete authorization checks. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-750301

CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable

Apache Syncope leaks nested secrets in cleartext into audit records readable by unauthorized users; affects 3.0.x, 4.0.x, and 4.1.x versions.

CVE-2026-75015 is an insufficiently protected credentials vulnerability in Apache Syncope where audit events expose nested secrets in cleartext to users able to read those records. Affected component is syncope-core-provisioning-java 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity, and users should upgrade to fixed releases.

oss-security · 1d agoVulnerabilityCVE-2026-75015

CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions

Apache Syncope non-recursive Any search can skip Realms restrictions, exposing objects outside an administrator's authorized realm (CVE-2026-73579).

CVE-2026-73579 is an incorrect authorization vulnerability in Apache Syncope where non-recursive Any search requests are transformed in a way that skips Realms restrictions, returning objects outside the administrator's authorized realm. Affected component is syncope-core-persistence-common 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity.

oss-security · 1d agoVulnerabilityCVE-2026-73579

CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles

Apache Syncope CVE-2026-73470 lets delegated users grant roles they do not own via crafted delegations.

Apache Syncope disclosed CVE-2026-73470, an improper privilege management vulnerability rated important. Delegations can be created or updated so that delegated users are able to grant roles they do not own, breaking ownership constraints. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users are advised to upgrade to the latest fixed releases.

oss-security · 1d agoVulnerabilityCVE-2026-73470

CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration

Apache Syncope CVE-2026-73236 bypasses delegated administration checks for sibling Realms sharing a name prefix.

Apache Syncope disclosed CVE-2026-73236, an important-rated incorrect authorization vulnerability. Delegated administration checks are enforced via Realm hierarchy prefix matches, so two sibling Realms whose names begin with the same string cannot be correctly distinguished, allowing delegated admins to act outside their assigned Realm. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed versions.

oss-security · 1d agoVulnerability 3 sourcesCVE-2026-732361

CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection

Apache Syncope CVE-2026-73195 allows authenticated users to inject spreadsheet formulas into CSV exports.

Apache Syncope disclosed CVE-2026-73195, a moderate-rated improper encoding or escaping of output vulnerability. Authenticated users can inject spreadsheet formulas into data that is later exported as CSV, which may execute when an administrator opens the file in a spreadsheet application. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-73195

CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers

Apache Syncope SRA CVE-2026-73191 enables CAS service URL injection via Forwarded HTTP headers.

Apache Syncope disclosed CVE-2026-73191, a moderate-rated open redirect vulnerability in the Syncope SRA. When the SRA is configured for CAS authentication, the target Apereo CAS service URL can be manipulated through Forwarded HTTP headers, redirecting users to an untrusted site. The flaw affects syncope-sra in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed releases.

oss-security · 1d agoVulnerabilityCVE-2026-73191

CVE-2026-73178: Apache Syncope: JWT Access Token takeover

Apache Syncope discloses CVE-2026-73178, an important-severity flaw enabling JWT access token takeover in versions 3.0.x through 4.1.2.

Apache Syncope disclosed CVE-2026-73178, an Exposure of Sensitive Information to an Unauthorized Actor vulnerability rated important that allows JWT access token takeover. Affected versions include syncope-core-provisioning-java 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to the latest fixed releases.

oss-security · 1d agoVulnerabilityCVE-2026-731781

CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow Akeyless provider before 0.3.1 lets DAG authors bypass team-scope guards and read other teams' secrets.

CVE-2026-86465 (moderate) affects apache-airflow-providers-akeyless before 0.3.1. The Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key: in multi-team deployments, a DAG author scoped to one team can supply a Variable key containing a path separator that resolves a secret belonging to another team.

oss-security · 9h agoVulnerabilityCVE-2026-86465

CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow FAB provider before 3.9.0 skips issuer/audience validation on Authentik id_tokens, allowing tokens minted for other clients to authenticate to Airflow.

CVE-2026-86466 affects apache-airflow-providers-fab before 3.9.0. The Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of accepted id_tokens. An attacker holding a token minted by the same Authentik identity provider for a different client application can present it to Airflow and be authenticated. Severity is rated moderate by the reporter.

oss-security · 9h agoVulnerability 3 sourcesCVE-2026-864661

CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider 2.0.0-3.8.x lets deactivated users keep unexpired Core API JWTs and mint replacements indefinitely.

CVE-2026-82310 affects apache-airflow-providers-fab versions 2.0.0 before 3.9.0. Deactivating a user account does not stop tokens issued before deactivation. While password authentication correctly rejects the disabled account, the Core API continues to accept an existing unexpired token naming it and lets that token mint a replacement. Severity is rated moderate.

oss-security · 9h agoVulnerabilityCVE-2026-82310

CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider before 0.10.0 lets any confidential client's credentials in the realm mint an Airflow session JWT.

CVE-2026-76187 affects apache-airflow-providers-keycloak before 0.10.0. The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so credentials of an unrelated application can obtain an Airflow session JWT. Severity is rated moderate.

oss-security · 9h agoVulnerability 2 sourcesCVE-2026-76187

CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

Unauthenticated attackers can forge Apache ZooKeeper operational log lines via newline injection in crafted ensemble authentication requests.

CVE-2026-84501 (moderate severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters. The forged entries could mislead operators or corrupt log-based monitoring and forensics.

oss-security · 11h agoVulnerabilityCVE-2026-845011

CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

Apache ZooKeeper audit logs are vulnerable to arbitrary field injection by unauthenticated attackers via tab characters in digest auth requests.

CVE-2026-84439 (important severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6 when audit logging is enabled (zookeeper.audit.enable=true). An unauthenticated attacker can inject arbitrary fields into the audit log by sending a digest authentication request with embedded tab characters, undermining audit trail integrity and potentially enabling log-analysis evasion or spoofing.

oss-security · 11h agoVulnerabilityCVE-2026-84439

CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

CVE-2026-59969: Apache ZooKeeper quorum TLS skips peer hostname verification in FIPS-mode deployments, enabling potential server-to-server impersonation.

Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 fail to enforce peer hostname verification for quorum TLS when FIPS mode is enabled with sslQuorum, zookeeper.fips-mode, and hostname verification settings turned on. The flaw is rated important and could allow an attacker to impersonate a quorum peer via certificate host mismatch. Users should upgrade to fixed versions.

oss-security · 11h agoVulnerabilityCVE-2026-59969

CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

CVE-2026-59739: Apache ZooKeeper missing ACL check in SetWatches reconnect replay lets attackers discover ACL-restricted znode paths.

Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 contain a critical information disclosure (CVE-2026-59739) caused by a missing ACL check during SetWatches reconnect replay. An attacker can register exists-watches on non-existent paths and reconnect after those paths are created, revealing the existence of ACL-restricted paths. The issue is fixed in patched releases.

oss-security · 11h agoVulnerabilityCVE-2026-59739

CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

Apache Syncope's Neo4j persistence layer permits Cypher injection via certain FIQL search expressions, affecting versions through 3.0.16, 4.0.7, and 4.1.2.

CVE-2026-86460 is a moderate-severity Cypher injection in Apache Syncope's syncope-core-persistence-neo4j module, triggered when processing some FIQL search strings. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation is reported; upgrade to fixed releases is advised.

oss-security · 1d agoVulnerabilityCVE-2026-864601

CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search

Apache Syncope's JPA persistence layer allows SQL injection via the sort parameter in Task search, affecting all releases through 4.1.2.

CVE-2026-82232 is rated important by upstream: improper neutralization of special elements in an SQL command allows SQL injection through the sort parameter in Task search within syncope-core-persistence-jpa. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation in the wild is reported.

oss-security · 1d agoVulnerability 2 sourcesCVE-2026-82232

CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

Apache Syncope Console and Enduser UIs suffer unauthenticated reflected XSS via notification messages, affecting versions 4.0.4 through 4.1.2.

CVE-2026-78318 is a moderate-severity cross-site scripting flaw in Apache Syncope's syncope-client-idrepo-common-ui module. The notification message, optionally shown by the Console and Enduser UIs, is improperly neutralized, enabling unauthenticated reflected XSS. Affected versions are 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2; no exploitation is reported.

oss-security · 1d agoVulnerabilityCVE-2026-783181

CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Unvalidated topology dependency keys in Apache Storm Nimbus 3.0.0 enable cross-tenant blob deletion and cluster denial of service.

CVE-2026-82441 (severity: moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Topology submissions carry dependency_jars and dependency_artifacts blobstore key lists that Nimbus never validated on the submission path, yet acted on during cleanup of finished topologies. A malicious submitter could reference arbitrary blobstore keys, causing cross-tenant blob deletion and cluster-wide denial of service.

oss-security · 2d agoVulnerabilityCVE-2026-824411

CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC

Unauthenticated DRPC requests to Apache Storm 3.0.0 cause unbounded memory growth in the function-name queue map, enabling DoS.

CVE-2026-82439 (severity: important) affects Apache Storm DRPC (storm-server) versions 3.0.0 before 3.1.0. The DRPC server maintained a map from function name to request queue, creating an entry on first sight of a name, but no code path ever removed entries: request cleanup removed requests from queues but the queue objects and map entries persisted. An unauthenticated attacker could send requests for arbitrary function names to drive unbounded memory growth and crash the server.

oss-security · 2d agoVulnerabilityCVE-2026-82439

CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Three CORS misconfigurations in Apache Storm 3.0.0 let malicious web pages from arbitrary origins read authenticated API responses.

CVE-2026-82438 (severity: important) affects Apache Storm Webapp (storm-webapp) versions 3.0.0 before 3.1.0. Three separate mechanisms allowed a web page on an unrelated origin to read responses served to authenticated users, including the Logviewer reflecting the request's Origin header in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials. This enables a malicious site to silently exfiltrate authenticated Storm API and log data from a victim's browser session.

oss-security · 2d agoVulnerabilityCVE-2026-824381

CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

Apache Storm Logviewer ignores logs.users and logs.groups ACLs for daemon logs, letting unauthorized users read sensitive logs.

CVE-2026-82437 (severity: moderate) affects Apache Storm Logviewer (storm-webapp) versions 3.0.0 before 3.1.0. The Logviewer offers logs.users and logs.groups settings for operators to control who may read log content, but for daemon logs the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer. As a result, configured access controls were not enforced and unauthorized users could read daemon log content.

oss-security · 2d agoVulnerabilityCVE-2026-82437

CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.

CVE-2026-82435 (rated important) affects Apache Storm Worker (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. The worker's Netty message decoder sits ahead of SASL authentication handlers and processes frames before any authentication occurs. It allocates buffers sized from an attacker-controlled length field, so a single frame from an unauthenticated peer reaching the worker can exhaust memory. Users must upgrade to 3.1.0.

oss-security · 2d agoVulnerabilityCVE-2026-824353

CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Apache Storm Nimbus blobstore authorization bypass via rebalance configuration overrides, fixed in 3.1.0.

CVE-2026-82432 (rated moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Nimbus validates topology.blobstore.map against the calling subject only at topology submission time. The rebalance operation accepts configuration overrides and strips a small set of keys but never re-runs that validation, so a caller authorized only to rebalance a topology can introduce an unauthorized blobstore map.

oss-security · 2d agoVulnerabilityCVE-2026-82432

CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

Apache Storm Client 3.0.0 ACL bypass lets every authenticated principal bypass restrictions when nimbus.groups is set without nimbus.users.

CVE-2026-82431 affects Apache Storm Client (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. SimpleACLAuthorizer returned early when nimbus.users was empty, before evaluating nimbus.groups. Operators restricting cluster access by group alone received no restriction, so any authenticated principal could execute user-level commands. Fixed in version 3.1.0.

oss-security · 2d agoVulnerabilityCVE-2026-82431