CVE-2018-11779

Technical details about CVE-2018-11779 are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2019-0202

CVE-2019-0202 affects Apache Storm Logviewer: versions 0.9.1-incubating through 1.2.2 expose HTTP endpoints that allow reading arbitrary host files via the logviewer. The root cause is an information disclosure vulnerability in the log viewer endpoints, enabling reading files not intended for acc...

CVE-2021-38294

CVE-2021-38294 affects Apache Storm 2.x (<2.2.1) and 1.x (

CVE-2021-40865

CVE-2021-40865 affects Apache Storm: Unsafe Deserialization in the worker services of the Storm supervisor server enables pre-auth remote code execution. Vulnerable lines include Storm 2.2.x (upgrade to 2.2.1 or 2.3.0), 2.1.x (upgrade to 2.1.1), and 1.x (upgrade to 1.2.4). Other connected advisor...

CVE-2023-43123

CVE-2023-43123 affects Apache Storm (Storm-core) on Unix-like systems where a shared temporary directory can allow other local users to read sensitive data written by temp files created via File.createTempFile (permissions -rw-r--r-- by default). The issue is triggered when the system property 'j...

CVE-2017-9799

CVE-2017-9799 affects Apache Storm 1.x prior to 1.0.4 and 1.1.x prior to 1.1.1. The issue allows a topology owner to trick the supervisor into launching a worker as a different, non-root user, enabling exposure of that user’s credentials. Impact is described as potential credential compromise and...

CVE-2018-1332

Summary: CVE-2018-1332 affects Apache Storm up to v1.0.6, v1.2.1, and v1.1.2 (and earlier), enabling user impersonation when communicating with certain Storm Daemons. The connected sources reiterate that the vulnerability allows impersonation but do not provide a concrete fix, patch version, or m...

CVE-2018-8008

CVE-2018-8008 affects Apache Storm up to 1.0.6, 1.2.1, and 1.1.2, enabling arbitrary file write via specially crafted archives with path traversal filenames that extract outside the target directory. Connected advisories corroborate a ZipSlip-style flaw across multiple Storm releases. Remediation...

CVE-2018-1331

The provided connected documents confirm CVE-2018-1331 affects Apache Storm versions: 0.10.0–0.10.2, 1.0.0–1.0.6, 1.1.0–1.1.2, and 1.2.0–1.2.1. The vulnerability allows an attacker with access to a secure Storm cluster to execute arbitrary code as a different user. The available sources describe ...

CVE-2015-3188

The CVE-2015-3188 issue affects Apache Storm UI daemon: Storm 0.10.0-beta (before 0.10.0-beta1) allows remote attackers to execute arbitrary code via unspecified vectors. The root cause is the UI daemon handling requests in a way that permits code execution when exposed to unauthenticated/remote ...

CVE-2026-41081

Apache Storm versions up to 2.8.7 are vulnerable to an improper handling of TLS client authentication failures . When TLS transport is enabled without requiring client certificates (the default), the TlsTransportPlugin suppresses the SSLPeerUnverifiedException and assigns a fallback principal (CN...

CVE-2026-35337

Versions of Apache Storm prior to 2.8.6 are vulnerable to a deserialization of untrusted data flaw. When processing topology credentials via the Nimbus Thrift API , the software deserializes a base64-encoded TGT blob using ObjectInputStream.readObject() without sufficient class filtering or valid...

CVE-2014-0115

The CVE-2014-0115 entry describes a directory traversal vulnerability in the log viewer of Apache Storm 0.9.0.1. An attacker can use a .. sequence in the log file parameter to read arbitrary files, potentially exposing sensitive data. The connected sources reiterate this flaw (path traversal in A...

CVE-2026-35565

Apache Storm versions before 2.8.6 are vulnerable to Stored Cross-Site Scripting (XSS) due to unsanitized topology metadata. The Storm UI visualization component interpolates metadata—including component IDs, stream names, and grouping values—directly into HTML via innerHTML in the parseNode() an...