Remote Code Execution Vulnerability in Nimbus Scheduler for Apache Storm

CVE-2026-82440

What is CVE-2026-82440?

A vulnerability was identified in the Nimbus Scheduler of Apache Storm, which allows an authenticated user to invoke unauthorized class instantiation. This occurs due to a misconfigured allowlist, which defaults to accepting any class when unset. As a consequence, an attacker could exploit this by submitting jobs that instantiate unsafe classes, leading to resource exhaustion and unexpected behavior in a cluster environment. Notably, classes within Storm's own artifacts can trigger side effects, including the initiation of rogue ZooKeeper servers that consume vital system resources. To mitigate this, upgrading to version 3.1.0 is necessary, as it enforces a more secure whitelist approach. For those unable to upgrade immediately, it is recommended to explicitly specify the allowed classes in the configuration.

References