Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getTopologyPageInfo process. An attacker can access sensitive daemon configuration data, including authentication payloads and passwords, by sending requests to the topology page endpoints...

Insufficiently Protected Credentials

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getTopologyPageInfo process. An attacker can access sensitive daemon configuration data, including authentication...

CVE-2026-84179

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

PT-2026-91237

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology conf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id an...