What’s Vulnerable › Products

Apache Software Foundation Apache Storm vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your Apache Software Foundation Apache Storm version is affected

Latest Apache Software Foundation Apache Storm vulnerabilities

• CVE-2026-82434 — Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs (CVSS 6.5)
• CVE-2026-82433 — Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI (CVSS 6.5)
• CVE-2026-82431 — Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users (CVSS 9.8)
• CVE-2026-82428 — Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys (CVSS 8.8)
• CVE-2026-84179 — Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page (CVSS 6.5)
• CVE-2026-41081 — Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure (CVSS 6.5)
• CVE-2026-35565 — Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI (CVSS 5.4)
• CVE-2026-35337 — Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling (CVSS 8.8)
• CVE-2023-43123 — Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files (CVSS 5.5)
• CVE-2021-40865 — Unsafe Pre-Authentication Deserialization In Workers (CVSS 9.8)
• CVE-2021-38294 — Shell Command Injection Vulnerability in Nimbus Thrift Server (CVSS 9.8)
• CVE-2019-0202 — (CVSS 7.5)
• CVE-2018-11779 — (CVSS 9.8)
• CVE-2018-1331 — (CVSS 8.8)
• CVE-2018-8008 — (CVSS 5.5)
• CVE-2018-1332 — (CVSS 6.5)
• CVE-2014-0115 — (CVSS 7.5)
• CVE-2017-9799 — (CVSS 8.8)
• CVE-2015-3188 — (CVSS 9.8)