Apache Software Foundation Storm vulnerabilities

• apache software foundation storm nimbus Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name CVE-2026-82427 7.8 HighSeptember 14, 2026
• apache software foundation storm client Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys CVE-2026-82428 8.8 HighSeptember 14, 2026
• apache software foundation storm worker launcher Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher CVE-2026-82429 7.8 HighSeptember 14, 2026
• apache software foundation storm worker launcher Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant CVE-2026-82430 7.8 HighSeptember 14, 2026
• apache software foundation storm client Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users CVE-2026-82431 9.8 CriticalSeptember 14, 2026
• apache software foundation storm nimbus, storm ui +1 more Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI CVE-2026-82433 6.5 MediumSeptember 14, 2026
• apache software foundation storm nimbus Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides CVE-2026-82432 8.1 HighSeptember 14, 2026
• apache software foundation storm client, storm nimbus +1 more Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs CVE-2026-82434 10.0 CriticalSeptember 14, 2026
• apache software foundation storm worker Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder CVE-2026-82435 9.8 CriticalSeptember 14, 2026
• apache software foundation storm logviewer Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer CVE-2026-82437 4.3 MediumSeptember 14, 2026
• apache software foundation storm nimbus Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location CVE-2026-82426 6.5 MediumSeptember 14, 2026
• apache software foundation storm webapp Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins CVE-2026-82438 8.1 HighSeptember 14, 2026
• apache software foundation storm drpc Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC CVE-2026-82439 9.8 CriticalSeptember 14, 2026
• apache software foundation storm nimbus Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys CVE-2026-82441 9.1 CriticalSeptember 14, 2026
• apache software foundation storm nimbus, storm ui +1 more Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page CVE-2026-84179 6.5 MediumSeptember 14, 2026
• apache storm prometheus reporter Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections CVE-2026-40557 Fix available 4.8 MediumApril 27, 2026
• apache storm, apache software foundation storm client +1 more Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure CVE-2026-41081 Fix available 6.5 MediumApril 27, 2026
• apache storm, apache software foundation storm client +1 more Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling CVE-2026-35337 Fix available 8.8 HighApril 13, 2026
• apache storm, apache software foundation storm ui +1 more Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI CVE-2026-35565 Fix available 5.4 MediumApril 13, 2026
• apache storm Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files CVE-2023-43123 Fix available 5.5 MediumNovember 23, 2023
• apache storm Unsafe Pre-Authentication Deserialization In Workers CVE-2021-40865 Public exploitFix available EPSS 64.2% 9.8 CriticalOctober 25, 2021
• apache storm Shell Command Injection Vulnerability in Nimbus Thrift Server CVE-2021-38294 Public exploitFix available EPSS 83.8% 9.8 CriticalOctober 25, 2021
• apache storm Code execution in org.apache.storm:storm-core CVE-2018-1331 Fix available 8.8 HighJuly 10, 2018
• apache storm ZipSlip in org.apache.storm:storm-core CVE-2018-8008 Fix available 5.5 MediumJune 5, 2018
• apache storm Moderate severity vulnerability that affects org.apache.storm:storm-core CVE-2018-1332 Fix available 6.5 MediumJune 5, 2018
• apache storm Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user CVE-2017-9799 Fix available 8.8 HighAugust 9, 2017