CVE-2026-82428

Apache Storm 's storm jar --artifacts feature stored dependency jars under blob keys derived solely from the Maven coordinate (e.g., dep---.jar), making them predictable and identical across all tenants . When a key already existed, the uploader silently reused the existing blob without verifying...

CVE-2026-82431

Apache Storm 's SimpleACLAuthorizer contained a logic flaw: when nimbus.users was empty, the code returned early before evaluating nimbus.groups, silently ignoring group-based access controls. Operators who restricted cluster access by group alone received no restriction at all —every authenticat...

CVE-2026-82431 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...