Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getNimbusConf process. An attacker can obtain sensitive configuration data, including authentication payloads and keystore or truststore passwords, by making unauthorized requests to the...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getTopologyPageInfo process. An attacker can access sensitive daemon configuration data, including authentication payloads and passwords, by sending requests to the topology page endpoints...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...