Apache Software Foundation Storm Client vulnerabilities

• apache software foundation storm client Apache Storm Client: Deserialization of Untrusted Data from the State Store CVE-2026-82436 No scoreNovember 9, 2026
• apache software foundation storm client Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys CVE-2026-82428 8.8 HighSeptember 14, 2026
• apache software foundation storm client Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users CVE-2026-82431 9.8 CriticalSeptember 14, 2026
• apache software foundation storm client, storm nimbus +1 more Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs CVE-2026-82434 10.0 CriticalSeptember 14, 2026
• apache storm, apache software foundation storm client +1 more Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure CVE-2026-41081 Fix available 6.5 MediumApril 27, 2026
• apache storm, apache software foundation storm client +1 more Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling CVE-2026-35337 Fix available 8.8 HighApril 13, 2026