Apache Storm Nimbus instantiates any scheduler class when allowlist unset

1 source · 2 articlesFirst reported Nov 9, 2026 · 05:23 UTCUpdated Nov 11, 2026 · 03:21 UTC (17h ago)

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Storm Nimbus 3.0.0 before 3.1.0 treats an unset scheduler-strategy allowlist as allow-any, enabling arbitrary class instantiation.

Apache Storm Nimbus instantiates the class named by a topology's topology.scheduler.strategy when scheduling that topology. The allowlist meant to constrain the choice is treated as allow any class when it is unset, and the shipped defaults.yaml has no entry for it. The flaw, CVE-2026-82440, affects org.apache.storm:storm-client 3.0.0 before 3.1.0 and was reported on November 8 at moderate severity. Submitters can therefore control which class Nimbus instantiates. The oss-security post does not describe exploitation in the wild.

Key facts

CVE-2026-82440 affects storm-client 3.0.0 before 3.1.0.
An unset scheduler strategy allowlist is treated as allow any class.
Shipped defaults.yaml contains no allowlist entry.
Submitters control the class named by topology.scheduler.strategy.
Severity is moderate; reported November 8.

Analyze CVE-2026-82440 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Nov 8, 2026Scheduler strategy allowlist flaw reported · oss-security
Nov 9, 2026oss-security publishes CVE-2026-82440 notice · oss-security

What each outlet adds

beyond the shared facts

oss-securityFail-open allowlist lets submitters choose any scheduler class

CVEs: CVE-2026-82440 CVE-2026-94125

Vendors: Apache
Products: Apache Storm

Coverage

oldest first · one row per article · UTC

Nov 9, 05:23 UTC · 2d ago oss-securityFirst report
Apache Storm Nimbus vulnerability allows submitter-controlled class instantiation
Apache Storm Nimbus before 3.1.0 treats unset scheduler strategy whitelist as allow any class, enabling arbitrary class instantiation.
03:21 UTC · 17h ago oss-security
Apache Storm supervisor page leaks other topologies (CVE-2026-94125)
An authenticated Nimbus user can see host, port, owner and resources for topologies they cannot read.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-82440	Submitter-Controlled Class Instantiation in Apache Storm Nimbus	—	—		2d ago
CVE-2026-94125	Missing authorization in Apache Storm Nimbus worker placement	—	—		7h ago