1257 matches found
CVE-2026-84179
Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...
CVE-2026-82439
Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever removed an entry: request cleanup removed the request from its queue, and the shutdown path drained queues, but the queue object and its map...
CVE-2026-82429 Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher
Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...
CVE-2026-82429
Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...
CVE-2026-82429 Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher
Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...
EUVD-2026-77528
Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...
CVE-2026-82430
Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...
CVE-2026-82430 Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...
CVE-2026-82430 Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...
EUVD-2026-77527
Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...
CVE-2026-82431 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...
CVE-2026-82431
Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...
CVE-2026-82431 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...
EUVD-2026-77525
Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...
CVE-2026-82433 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...
CVE-2026-82433 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...
CVE-2026-82433
Apache Storm's Nimbus and UI components are vulnerable to the disclosure of unredacted daemon configurations. The getNimbusConf function failed to redact sensitive information, such as the storm.zookeeper.auth.payload and keystore/truststore passwords for Thrift, Netty, and ZooKeeper TLS configur...
EUVD-2026-77524
Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...
CVE-2026-82432 Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...
CVE-2026-82432
Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...