Apache Software Foundation Apache Storm Client vulnerabilities

3 CVEs affecting Apache Software Foundation Apache Storm Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-82434, published 2026-09-14.

More from Apache Software Foundation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-82428, published 2026-09-14. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep---.jar`. The key was therefore…
• CVE-2026-82434, published 2026-09-14. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it. Nimbus then served…
• CVE-2026-82431, published 2026-09-14. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered. An operator who restricted cluster…