CVE-2021-40865

CVE-2021-40865 CVE-2021-40865 POC/exploit-poc import org.apache.commons.io.IOUtils; import org.apache.storm.serialization.KryoValuesSerializer; import ysoserial.payloads.ObjectPayload; import ysoserial.payloads.URLDNS; import java.io.; import java.math.BigInteger; import java.net.; import...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +4 more potentially affected by CVE-2026-82427 via org.apache.storm:storm-server (3.0.0)

org.apache.storm:storm-server MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-server and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +27 more potentially affected by CVE-2026-82431 via org.apache.storm:storm-client (3.0.0)

org.apache.storm:storm-client MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-client and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +4 more potentially affected by CVE-2026-82439 via org.apache.storm:storm-server (3.0.0)

org.apache.storm:storm-server MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-server and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +4 more potentially affected by CVE-2026-82433 via org.apache.storm:storm-server (3.0.0)

org.apache.storm:storm-server MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-server and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +4 more potentially affected by CVE-2026-82432 via org.apache.storm:storm-server (3.0.0)

org.apache.storm:storm-server MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-server and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +1 more potentially affected by CVE-2026-82429 via org.apache.storm:storm-core (3.0.0)

org.apache.storm:storm-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-core and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +27 more potentially affected by CVE-2026-82435 via org.apache.storm:storm-client (3.0.0)

org.apache.storm:storm-client MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-client and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +4 more potentially affected by CVE-2026-82434 via org.apache.storm:storm-server (3.0.0)

org.apache.storm:storm-server MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-server and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +4 more potentially affected by CVE-2026-84179 via org.apache.storm:storm-server (3.0.0)

org.apache.storm:storm-server MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-server and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

CVE-2026-82438

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82431

Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...

CVE-2026-82435

Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer...

CVE-2026-82437

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

CVE-2026-82432

Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...

CVE-2026-82433

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

CVE-2026-82434

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

CVE-2026-82427

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...

CVE-2026-82429

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

CVE-2026-82426

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...