347 matches found
CVE-2021-40865
CVE-2021-40865 CVE-2021-40865 POC/exploit-poc import org.apache.commons.io.IOUtils; import org.apache.storm.serialization.KryoValuesSerializer; import ysoserial.payloads.ObjectPayload; import ysoserial.payloads.URLDNS; import java.io.; import java.math.BigInteger; import java.net.; import...
CVE-2026-124496
The Apache Storm DRPC HTTP endpoint contains a vulnerability where an authenticated client can act as another user by bypassing the configured impersonation authorizer . This allows an authenticated user to execute DRPC functions restricted to different users. To remediate this issue, users are r...
CVE-2026-124496 Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer
The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue...
CVE-2026-124495
The Apache Storm Logviewer is vulnerable to Improper Link Resolution Before File Access (CWE-59) when workers run as the topology owner. The Logviewer improperly follows links to files placed in a worker's log directory. This allows a user authorized to submit topologies to read the worker logs o...
CVE-2026-124495 Apache Storm: Logviewer follows worker symlinks across topology ACLs
When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are...
CVE-2026-94125
In Apache Storm , the Nimbus component suffers from a Missing Authorization (CWE-862) vulnerability. It improperly returns worker placement details for all topologies running on a supervisor, including the host , port , owner , and resource assignment . In multi-tenant environments, an authentica...
CVE-2026-94125 Apache Storm: Supervisor page discloses worker placement of other users' topologies
Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers o...
CVE-2026-124495: Apache Software Foundation Apache Storm: When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as…
When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are...
CVE-2026-94125: Apache Software Foundation Apache Storm: Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and…
Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers o...
CVE-2026-124496: Apache Software Foundation Apache Storm: The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation…
The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue...
CVE-2026-82436
Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party...
CVE-2026-82436
The DefaultStateSerializer component in Apache Storm (specifically when using the Redis-backed state provider ) is vulnerable to arbitrary code execution. The root cause is that the component configures Kryo with class registration disabled and an instantiation strategy that constructs objects wi...
CVE-2026-82436 Apache Storm Client: Deserialization of Untrusted Data from the State Store
Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party...
EUVD-2026-119926
Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party...
CVE-2026-82436
Description "DefaultStateSerializer", used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A par...
CVE-2026-82440 Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist
Description Nimbus instantiates the class named by a topology's topology.scheduler.strategy when scheduling it. The allowlist intended to constrain that choice, nimbus.scheduler.strategy.class.whitelist, was treated as "allow any class" when unset, and it had no entry in the shipped defaults.yaml...
CVE-2026-82436: Apache Software Foundation Apache Storm Client: Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class…
Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party...
CVE-2026-82440: Apache Software Foundation Apache Storm Nimbus: Description Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it
Description Nimbus instantiates the class named by a topology's topology.scheduler.strategy when scheduling it. The allowlist intended to constrain that choice, nimbus.scheduler.strategy.class.whitelist, was treated as "allow any class" when unset, and it had no entry in the shipped defaults.yaml...
PT-2026-140354
Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party...
Authorization Bypass
Apache Storm Logviewer is vulnerable to Authorization Bypass. The vulnerability is due to flawed access control logic that discards the authorizer’s decision for daemon logs and bypasses the authorizer entirely for the daemon log page and download endpoints, where the handler processes requests...