It was found that under some situations and configurations of Apache Storm 1.x before…
Priority MEDIUM 46Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
Why it matters now
EPSS 0.04872 92nd percentileScored 2026-11-07
Fix Fixed org.apache.storm:storm-core (Maven): 1.1.1, 1.0.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Storm | 1.0.0 through 1.0.3; 1.1.0 | — | No fix listed | CNA |
| — | org.apache.storm:storm-core (Maven) | 1.1.0 to before 1.1.1 | 1.1.1 | Patch available | GHSA-x825-rjww-2245 |
| — | org.apache.storm:storm-core (Maven) | 1.0.0 to before 1.0.4 | 1.0.4 | Patch available | GHSA-x825-rjww-2245 |
- Apache Storm VendorApache Affected 1.0.0 through 1.0.3; 1.1.0 Fixed in — No fix listed CNA
- org.apache.storm:storm-core (Maven) Vendor— Affected 1.1.0 to before 1.1.1 Fixed in 1.1.1 Patch available GHSA-x825-rjww-2245
- org.apache.storm:storm-core (Maven) Vendor— Affected 1.0.0 to before 1.0.4 Fixed in 1.0.4 Patch available GHSA-x825-rjww-2245
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:storm:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:storm:1.0.1:*:*:*:*:*:*:* | 1.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:storm:1.0.2:*:*:*:*:*:*:* | 1.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:storm:1.0.3:*:*:*:*:*:*:* | 1.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:storm:1.1:*:*:*:*:*:*:* | 1.1 | Vulnerable | Apache |
- cpe:2.3:a:apache:storm:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Apache
- cpe:2.3:a:apache:storm:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:storm:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:storm:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:storm:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Apache
Remediation
- Fix · GHSA-x825-rjww-2245 org.apache.storm:storm-core (Maven) Fixed in 1.1.1 Advisory →
- Fix · GHSA-x825-rjww-2245 org.apache.storm:storm-core (Maven) Fixed in 1.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-9799
- 2026-10-03 Alias added: GHSA-x825-rjww-2245
References
Advisory 2
More Apache Storm vulnerabilities
- TI-2021-15907 Shell Command Injection Vulnerability in Nimbus Thrift Server CVSS 3.1CRITICAL 9.8
- TI-2021-17787 Unsafe Pre-Authentication Deserialization In Workers CVSS 3.1CRITICAL 9.8
- TI-2015-02819 The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to… CVSS 3.0CRITICAL 9.8
- TI-2018-08436 Deserialization of untrusted data in Apache Storm CVSS 3.0CRITICAL 9.8
- TI-2018-01232 In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and… CVSS 3.0HIGH 8.8
- TI-2026-27475 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling CVSS 3.1HIGH 8.8
Sources
- CVE-2017-9799 · CVE Program
- CVE-2017-9799 · NVD
- FIRST EPSS
- GHSA-x825-rjww-2245 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences