Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

14 records

Vendor: Apache Component: Storm Clear all filters
TI-2026-29718 CVE-2026-41081 · GHSA-j2q8-xx3q-8fqh

Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure

Priority LOW 35

Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00286 Published 2026-04-27 Fixed in 2.8.7 CWE-287
TI-2026-27671 CVE-2026-35565 · GHSA-f2hp-qw27-8wfq

Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI

Priority LOW 25

Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The Storm UI visualization component interpolates topology metadata including component…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00466 Published 2026-04-13 Fixed in 2.8.6 CWE-79
TI-2021-17787 CVE-2021-40865 · GHSA-w729-7633-2fw5

Unsafe Pre-Authentication Deserialization In Workers

Priority HIGH 78

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.6418 Published 2021-10-25 Fixed in v1.2.4, 2.2.1 +2 CWE-502
TI-2021-15907 CVE-2021-38294 · GHSA-6768-mcjc-8223

Shell Command Injection Vulnerability in Nimbus Thrift Server

Priority HIGH 83

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83805 Published 2021-10-25 Fixed in v1.2.4, 2.2.1 +2 CWE-74
TI-2018-08436 CVE-2018-11779 · GHSA-25pc-85qf-6j69

Deserialization of untrusted data in Apache Storm

Priority MEDIUM 48

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03477 Published 2019-07-25 Fixed in 1.2.3 CWE-502
TI-2019-00178 CVE-2019-0202 · GHSA-r9pv-hg64-jqrp

Information disclosure in Apache Storm

Priority LOW 37

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02043 Published 2019-07-25 Fixed in 1.2.3 CWE-200
TI-2018-01232 CVE-2018-1331 · GHSA-p8jx-x2vw-wm33

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and…

Priority MEDIUM 45

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04424 Published 2018-07-10 Fixed in 1.2.2, 1.1.3
TI-2018-05785 CVE-2018-8008 · GHSA-898j-5cc8-cmf5

Path traversal in Apache Storm

Priority LOW 29

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as…

CVSS 3.0MEDIUM 5.5 Local No auth User interaction EPSS 0.02247 Published 2018-06-05 Fixed in 1.1.3, 1.2.2 +1 CWE-22
TI-2018-01233 CVE-2018-1332 · GHSA-q35p-chc6-7x57

Information disclosure in Apache Storm

Priority LOW 32

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01413 Published 2018-06-05 Fixed in 1.1.3, 1.2.2 CWE-200
TI-2017-07179 CVE-2017-9799 · GHSA-x825-rjww-2245

It was found that under some situations and configurations of Apache Storm 1.x before…

Priority MEDIUM 46

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.04872 Published 2017-08-09 Fixed in 1.1.1, 1.0.4