Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Storm Client

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-82431

    Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

    Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered. An operator who restricted cluster access by group alone, leaving `nimbus.users` unset, therefore r…

    Apache Software Foundation Apache Storm Client
  • Critical 10.0
    CVE-2026-82434

    Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

    Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only …

    Apache Software Foundation Apache Storm Nimbus Apache Storm Client