Apache Storm Client (Apache Software Foundation) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-14. Vendor: Apache Software Foundation.

CVEs of Apache Storm Client

• CVE-2026-82428 - CVSS 8.8 (high), 2026-09-14: Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example…
• CVE-2026-82431 - CVSS 9.8 (critical), 2026-09-14: Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was…
• CVE-2026-82434 - CVSS 10 (critical), 2026-09-14: Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration,…
• CVE-2026-41081 - CVSS 6.5 (medium), 2026-04-27: Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description:…
• CVE-2026-35337 - CVSS 8.8 (high), 2026-04-13: Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted…