Vulnerabilities

TI-2026-56836 CVE-2026-82433 · GHSA-3p33-32v8-fg8j

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

LOW 29

Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00339 Published 2026-09-14 Fixed in 3.1.0 CWE-522

TI-2026-57880 CVE-2026-84179 · GHSA-gp9q-jh3g-h72p

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

LOW 29

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00435 Published 2026-09-14 Fixed in 3.1.0 CWE-200

Vulnerabilities

Filters

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page