Apache Software Foundation Apache Storm Nimbus vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Latest Apache Software Foundation Apache Storm Nimbus vulnerabilities

CVE-2026-82434 — Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs (CVSS 6.5)
CVE-2026-82433 — Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI (CVSS 6.5)
CVE-2026-82432 — Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides (CVSS 8.1)
CVE-2026-82427 — Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name (CVSS 7.8)
CVE-2026-82426 — Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location (CVSS 6.5)
CVE-2026-84179 — Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page (CVSS 6.5)
CVE-2026-82441 — Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys (CVSS 9.1)