Apache Storm Nimbus vulnerability allows submitter-controlled class instantiation
Apache Storm Nimbus before 3.1.0 treats unset scheduler strategy whitelist as allow any class, enabling arbitrary class instantiation.
Stories per day · 30 days
6 stories, newest first · one card per story
Stories tagged #nimbus
CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
Apache Storm Nimbus/UI 3.0.0 leaks unredacted merged daemon configuration through the topology page, exposing secrets to UI users.
CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
Unvalidated topology dependency keys in Apache Storm Nimbus 3.0.0 enable cross-tenant blob deletion and cluster denial of service.
CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
Apache Storm Nimbus and UI return unredacted daemon configuration, including ZooKeeper and keystore secrets, to authorized users.
CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
Apache Storm Nimbus blobstore authorization bypass via rebalance configuration overrides, fixed in 3.1.0.
CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location
Apache Storm Nimbus 3.0.0 before 3.1.0 allows arbitrary server-side file read via unvalidated uploadedJarLocation in submitTopology calls.