CVE-2021-38294: Apache Storm

Critical severity, CVSS 9.8. EPSS: 83.8% chance of exploitation in the next 30 days.

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Affected products

• Apache Storm: from 1.0.0, before 1.2.4 (fixed in 1.2.4); from 2.1.0, before 2.1.1 (fixed in 2.1.1); from 2.2.0, before 2.2.1 (fixed in 2.2.1)

Published 2021-10-25. Last modified 2026-06-17.