[<prev] [next>] [day] [month] [year] [list]
Message-ID: <306d96f0-e0eb-cb4a-96a4-633a71e14e10@apache.org>
Date: Wed, 11 Nov 2026 02:08:18 +0000
From: Rui Abreu <rabreu@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-94125: Apache Storm: Supervisor page discloses worker
placement of other users' topologies
Severity: low
Affected versions:
- Apache Storm (org.apache.storm:storm-server) 2.0.0 before 3.2.0
Description:
Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue.
Credit:
kta1kri, independent researcher (finder)
References:
https://storm.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-94125
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
