Apache Storm Nimbus (Apache Software Foundation) - vulnerabilities (CVEs)
7 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-14. Vendor: Apache Software Foundation.
CVEs of Apache Storm Nimbus
- CVE-2026-82427 - CVSS 7.8 (high), 2026-09-14: Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to…
- CVE-2026-82433 - CVSS 6.5 (medium), 2026-09-14: Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is…
- CVE-2026-82432 - CVSS 8.1 (high), 2026-09-14: Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration…
- CVE-2026-82434 - CVSS 10 (critical), 2026-09-14: Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration,…
- CVE-2026-82426 - CVSS 6.5 (medium), 2026-09-14: Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and opened it directly,…
- CVE-2026-82441 - CVSS 9.1 (critical), 2026-09-14: Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading…
- CVE-2026-84179 - CVSS 6.5 (medium), 2026-09-14: Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the…
