Advisories · Technology

Apache Software Foundation Apache Storm Client.

Every CVE that names Apache Software Foundation Apache Storm Client among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-82428 CVE record

CVSS 8.8 High

Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys
- Apache Software Foundation Apache Storm Client
- Path traversal
Not analysed yet 14 Sept 2026
CVE-2026-82431 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
- Apache Software Foundation Apache Storm Client
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2026-82434 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
- Apache Software Foundation Apache Storm Nimbus
- Apache Software Foundation Apache Storm Client
- Hard-coded credentials
- Information disclosure
Not analysed yet 14 Sept 2026