ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “apache-storm”

25 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAll
SeverityAllcritical 0high 0medium 0low 0info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

CVE-2026-57822: Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service

Apache fixed CVE-2026-57822, a deserialization flaw in ActiveMQ Artemis management messaging letting authorized clients trigger broker denial of service.

Apache disclosed a deserialization issue in message-based management request handling for Apache Artemis and Apache ActiveMQ Artemis. It affects Apache Artemis (artemis-core-client) 2.50.0 through 2.56.0 and ActiveMQ Artemis (artemis-core-client) 1.3.0 through 2.44.0. Exploitation requires an authenticated client authorized with MANAGE permission using management-via-messaging; parameter processing can trigger denial of service. Apache rates the issue as important.

oss-security · 6d agoVulnerability 7 sourcesCVE-2026-57822

Artifactory flaws chained in attacks deploying backdoor malware

Attackers chain JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 to gain admin tokens and deploy a Rust backdoor on self-hosted servers.

Wiz observed multiple threat actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory instances between August 15 and September 8, 2026, in some cases obtaining admin access in under five minutes. The critical authentication bypass CVE-2026-82329 was also exploited this month to mint administrator tokens. Attackers installed malicious Groovy plugins, dropped a Rust backdoor with C2 capabilities, uploaded webshells, stole configuration data and cluster join keys, and added SSH keys to new accounts. Wiz estimates 49-62% of internet-reachable Artifactory instances are vulnerable to at least one of the three flaws, and patched releases from 7.111.21 through 7.161.20 are available.

BleepingComputerupdated · 2d agofirst · 5d agoExploit / PoC in the wild 7 sourcesCVE-2026-42018CVE-2026-42016CVE-2026-823291

Re: CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

Follow-up on oss-security asks why CVE-2026-82434, Apache Storm ZooKeeper credential disclosure to read-only users and logs, lacks a severity rating.

Gabriel Ravier replied to the oss-security disclosure thread for CVE-2026-82434, which affects Apache Storm Nimbus and Apache Storm Client. The vulnerability involves disclosure of the topology ZooKeeper credential to read-only users and to logs. The reply questions whether the CVE was filed without a severity rating or if it is simply missing from the listing. No exploitation details or affected versions are provided in the post.

oss-security · 3d agoVulnerability 2 sourcesCVE-2026-82434

CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Three CORS misconfigurations in Apache Storm 3.0.0 let malicious web pages from arbitrary origins read authenticated API responses.

CVE-2026-82438 (severity: important) affects Apache Storm Webapp (storm-webapp) versions 3.0.0 before 3.1.0. Three separate mechanisms allowed a web page on an unrelated origin to read responses served to authenticated users, including the Logviewer reflecting the request's Origin header in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials. This enables a malicious site to silently exfiltrate authenticated Storm API and log data from a victim's browser session.

oss-security · 3d agoVulnerabilityCVE-2026-824381

CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Apache Storm stores shared dependency jars under predictable Maven-derived blob keys, allowing one tenant to substitute jars other tenants execute.

CVE-2026-82428 affects Apache Storm Client (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0, rated important. Dependency artifacts uploaded with storm jar --artifacts were stored under blob keys derived only from the Maven coordinate, making keys identical and predictable for every cluster user. When a blob already existed, the uploader suppressed the collision, enabling a tenant to substitute dependency jars later executed by other tenants in cross-tenant attacks. Fixed in version 3.1.0.

oss-security · 3d agoVulnerabilityCVE-2026-82428

CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.

CVE-2026-82435 (rated important) affects Apache Storm Worker (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. The worker's Netty message decoder sits ahead of SASL authentication handlers and processes frames before any authentication occurs. It allocates buffers sized from an attacker-controlled length field, so a single frame from an unauthenticated peer reaching the worker can exhaust memory. Users must upgrade to 3.1.0.

oss-security · 3d agoVulnerabilityCVE-2026-824353

CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC

Unauthenticated DRPC requests to Apache Storm 3.0.0 cause unbounded memory growth in the function-name queue map, enabling DoS.

CVE-2026-82439 (severity: important) affects Apache Storm DRPC (storm-server) versions 3.0.0 before 3.1.0. The DRPC server maintained a map from function name to request queue, creating an entry on first sight of a name, but no code path ever removed entries: request cleanup removed requests from queues but the queue objects and map entries persisted. An unauthenticated attacker could send requests for arbitrary function names to drive unbounded memory growth and crash the server.

oss-security · 3d agoVulnerabilityCVE-2026-82439

CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Unvalidated topology dependency keys in Apache Storm Nimbus 3.0.0 enable cross-tenant blob deletion and cluster denial of service.

CVE-2026-82441 (severity: moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Topology submissions carry dependency_jars and dependency_artifacts blobstore key lists that Nimbus never validated on the submission path, yet acted on during cleanup of finished topologies. A malicious submitter could reference arbitrary blobstore keys, causing cross-tenant blob deletion and cluster-wide denial of service.

oss-security · 3d agoVulnerabilityCVE-2026-824411

CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

Apache Storm Nimbus/UI 3.0.0 leaks unredacted merged daemon configuration through the topology page, exposing secrets to UI users.

CVE-2026-84179 (severity: important) affects Apache Storm Nimbus (storm-server) and Storm UI (storm-webapp) versions 3.0.0 before 3.1.0. The getTopologyPageInfo function merged the Nimbus daemon configuration with topology configuration and returned it unredacted in the topology_conf field of TopologyPageInfo, which the Storm UI copied verbatim. This can expose sensitive daemon configuration values to topology users.

oss-security · 3d agoVulnerabilityCVE-2026-84179

CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

Apache Storm Logviewer ignores logs.users and logs.groups ACLs for daemon logs, letting unauthorized users read sensitive logs.

CVE-2026-82437 (severity: moderate) affects Apache Storm Logviewer (storm-webapp) versions 3.0.0 before 3.1.0. The Logviewer offers logs.users and logs.groups settings for operators to control who may read log content, but for daemon logs the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer. As a result, configured access controls were not enforced and unauthorized users could read daemon log content.

oss-security · 3d agoVulnerabilityCVE-2026-82437

CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

Apache Storm's setuid-root worker-launcher re-resolves paths during recursive chown/chmod, letting local users win a race to escalate to root.

CVE-2026-82429 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. The setuid-root worker-launcher walks worker directories with FTS calling lchown and chmod on full pathnames while running with effective uid 0, and both syscalls re-resolve the path at call time. A local attacker can exploit this time-of-check race by swapping path components to gain root privileges. Fixed in version 3.1.0.

oss-security · 3d agoVulnerabilityCVE-2026-82429

CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

Apache Storm Nimbus and UI return unredacted daemon configuration, including ZooKeeper and keystore secrets, to authorized users.

CVE-2026-82433 (rated moderate) affects Apache Storm Nimbus (storm-server) and Storm UI (storm-webapp) versions 3.0.0 before 3.1.0. The getNimbusConf operation returned the complete daemon configuration without redaction after only a user-level authorization check. Where configured, the response includes storm.zookeeper.auth.payload plus keystore and related secrets.

oss-security · 3d agoVulnerabilityCVE-2026-82433

CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

Unsanitised topology.blobstore.map local names in Apache Storm enable path traversal writes on supervisors as the supervisor user.

CVE-2026-82427 affects Apache Storm Nimbus (org.apache.storm:storm-server) versions 3.0.0 before 3.1.0, rated important. Topology submitters can choose a local name for each blob in topology.blobstore.map, which AsyncLocalizer and Container.createBlobstoreLinks used to build paths under the topology's working directory without normalisation. Crafted names allow path traversal, letting a submitter create or overwrite files outside the intended directory on supervisors, with symlink handling also affected. Fixed in version 3.1.0.

oss-security · 3d agoVulnerabilityCVE-2026-82427

CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

Apache Storm Client 3.0.0 ACL bypass lets every authenticated principal bypass restrictions when nimbus.groups is set without nimbus.users.

CVE-2026-82431 affects Apache Storm Client (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. SimpleACLAuthorizer returned early when nimbus.users was empty, before evaluating nimbus.groups. Operators restricting cluster access by group alone received no restriction, so any authenticated principal could execute user-level commands. Fixed in version 3.1.0.

oss-security · 3d agoVulnerabilityCVE-2026-82431

CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Apache Storm Nimbus blobstore authorization bypass via rebalance configuration overrides, fixed in 3.1.0.

CVE-2026-82432 (rated moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Nimbus validates topology.blobstore.map against the calling subject only at topology submission time. The rebalance operation accepts configuration overrides and strips a small set of keys but never re-runs that validation, so a caller authorized only to rebalance a topology can introduce an unauthorized blobstore map.

oss-security · 3d agoVulnerabilityCVE-2026-82432

CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Setuid-root Apache Storm worker-launcher chowns worker directory to the tenant before reading its command file, enabling local root privilege escalation.

CVE-2026-82430 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. When launching Docker or OCI workers, the setuid-root worker-launcher transfers ownership of the entire worker directory to the untrusted topology user before reading and acting on the supervisor-written command file in that directory. An untrusted tenant can tamper with the command file to achieve local privilege escalation to root. Fixed in version 3.1.0.

oss-security · 3d agoVulnerabilityCVE-2026-82430

CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

Apache Storm Nimbus 3.0.0 before 3.1.0 allows arbitrary server-side file read via unvalidated uploadedJarLocation in submitTopology calls.

CVE-2026-82426 (rated important) affects Apache Storm Nimbus (org.apache.storm:storm-server) versions 3.0.0 before 3.1.0. Nimbus accepted the uploadedJarLocation argument of submitTopology/submitTopologyWithOpts as a server-side path and opened it directly, without verifying the caller had actually uploaded that file via beginFileUpload. This enables arbitrary file read on the Nimbus host; the issue is fixed in version 3.1.0.

oss-security · 3d agoVulnerabilityCVE-2026-824261

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackersupdated · 5d agofirst · 5d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

CVE-2026-57866: Apache Impala: Secrets Exfiltration via SSRF

Apache Impala CVE-2026-57866 lets authenticated users abuse ai_generate_text() to exfiltrate secrets from configured Hadoop credential providers via SSRF.

A server-side request forgery affects Apache Impala versions 4.4.0 through 4.5.1. Authenticated users with permission to execute the ai_generate_text() function can exfiltrate secrets provided by credential providers configured via hadoop.security.credential.provider.path in core-site.xml. The attacker must know the secret's key name, and Apache rates the issue 'important'.

oss-security · 7d agoVulnerability 3 sourcesCVE-2026-57866

Storm-1175 Replaces Medusa With New StormEncryptor Ransomware

Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.

Microsoft Threat Intelligence reports that the financially motivated, China-linked group Storm-1175 began deploying a new ransomware strain called StormEncryptor on August 2, 2026, replacing its previous Medusa ransomware. StormEncryptor is written in C++, appends the .encrypted extension to files, and drops a !!!README_FIRST!!!.txt ransom note in each scanned directory. Microsoft assesses the group is likely exploiting CVE-2026-18577, an authentication bypass in N-able disclosed on August 2, 2026 and added to CISA's Known Exploited Vulnerabilities catalog the next day. Since 2023, Storm-1175 has exploited more than 16 vulnerabilities in products including Microsoft Exchange, Ivanti, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, and GoAnywhere MFT, often moving from initial access to data theft and ransomware deployment within days.

Security Affairs · Aug 13, 2026Ransomware in the wildCVE-2026-18577CVE-2026-1731CVE-2023-21529+15 CVEs1

CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery

Apache Impala CVE-2026-54048 lets crafted Avro schema URLs trigger SSRF to internal endpoints, with responses potentially leaking via error messages.

A server-side request forgery in Apache Impala 2.0.0 through 4.5.1 on all platforms can be triggered via an Avro schema URL using an http or file:/// URI on a table. An attacker can cause Impala to send GET requests to internal endpoints it can access, and responses may be exposed through parsing error messages. Users are advised to upgrade to a fixed release.

oss-security · 7d agoVulnerabilityCVE-2026-540481

CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing

Apache MyFaces fixes critical CVE-2026-76646, a remote denial-of-service flaw triggered by crafted request parameters across versions 2.2.0-4.1.3.

Apache MyFaces disclosed CVE-2026-76646, a critical denial-of-service vulnerability in which remote attackers can cause excessive resource consumption by supplying specially crafted request parameters. Affected versions span 2.2.0-2.2.15, 2.3.0-2.3.11, 3.0.0-3.0.3, 4.0.0-4.0.3, 4.1.0-4.1.3 and 2.3-next-*. The disclosure notes older versions may also be impacted.

oss-security · 4h agoVulnerability 2 sourcesCVE-2026-76646

New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.

Darktrace identified a new 64-bit ELF variant of the Chaos botnet targeting misconfigured cloud deployments, expanding beyond the malware's traditional focus on routers and edge devices. Captured in a deliberately misconfigured Hadoop honeypot instance, the intrusion began with an HTTP request creating an application that ran embedded shell commands to fetch the Chaos agent binary from pan.tenire[.]com, set chmod 777 permissions, execute it, and delete the artifact to reduce forensic traces. The restructured variant adds a SOCKS proxy feature letting compromised systems ferry attacker traffic, while removing SSH-based spread and router-exploit functions, suggesting monetization beyond crypto mining and DDoS-for-hire. Possible Chinese origin is suggested by language artifacts and infrastructure; the delivery domain was previously used in Silver Fox's Operation Silk Lure phishing campaign delivering ValleyRAT.

The Hacker News · 29d agoMalware1

CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions

Apache Syncope non-recursive Any search can skip Realms restrictions, exposing objects outside an administrator's authorized realm (CVE-2026-73579).

CVE-2026-73579 is an incorrect authorization vulnerability in Apache Syncope where non-recursive Any search requests are transformed in a way that skips Realms restrictions, returning objects outside the administrator's authorized realm. Affected component is syncope-core-persistence-common 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity.

oss-security · 2d agoVulnerabilityCVE-2026-73579

Mirai Variant V3G4 Targets IoT Devices

Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.

From July to December 2022, Unit 42 observed three campaigns spreading V3G4, a Mirai botnet variant, by exploiting 13 vulnerabilities, including CVE-2022-26134 in Atlassian Confluence and CVE-2019-15107 in Webmin. The campaigns shared the same C2 domains containing the string 8xl9, nearly identical shell script downloaders, and the same XOR keys, suggesting a single threat actor. The malware brute-forces telnet and SSH credentials, terminates rival botnet processes via a stop list, and receives DDoS commands from its C2. Compromised servers and networking devices are absorbed into the botnet for further attacks.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wildCVE-2012-4869CVE-2014-9727CVE-2017-5173+6 CVEs