Unauthorized Access in Nimbus Supervision Affects Apache Software
CVE-2026-94125

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Storm
Vendor
CVE Published:
11 November 2026

What is CVE-2026-94125?

The vulnerability in Apache Nimbus allows authenticated users to view sensitive information regarding the placement of workers for various topologies in a multi-tenant cluster. This exposure can lead to unauthorized access to data and resource allocation details that the user should not be privy to. To mitigate this risk, it is crucial for users to upgrade to version 3.2.0, which addresses this security concern.

Affected Version(s)

Apache Storm 2.0.0 < 3.2.0

References

https://lists.apache.org/thread/8of7kv48thj82bb8vqrz6wbgl...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kta1kri, independent researcher
.