CVE-2026-94125: Apache Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read
This Apache advisory covers CVE-2026-94125. Related products: Apache Storm.
- CVE-2026-94125
Key facts
- Vendor rating
- Low
- Weakness
- CWE-862 Missing Authorization
- CISA KEV
- Not listed (catalogue checked )
- Versions named
- Apache Storm 2.0.0 before 3.2.0
- Fixed in
- 3.2.0
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Related products & platforms
Description
Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run.
Users are recommended to upgrade to version 3.2.0, which fixes the issue.
Affected product named by the advisory: Apache Storm.
Text from the source record.
- Apache Storm 2.0.0 before 3.2.0
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-94125
Upgrade to a fixed release named by Apache:
- 3.2.0
Vendor guidance
- Users are recommended to upgrade to version 3.2.0, which fixes the issue.
More Apache Software Foundation advisories
CVE-2026-124496Nov 11, 2026The DRPC HTTP endpoint lets an authenticated client act as another user without applyingCVE-2026-124495Nov 11, 2026When workers run as the topology owner, the Logviewer serves filesCVE-2026-82436Nov 9, 2026Apache Storm: Description `DefaultStateSerializer`, used to persist and restore statefulCVE-2026-82427Sep 14, 2026Apache Storm: Description A topology's `topology.blobstore.map` lets the submitter chooseCVE-2026-82428Sep 14, 2026Apache Storm: Description Dependency artifacts uploaded with `storm jar --artifacts`CVE-2026-82429Sep 14, 2026Apache Storm: Description The setuid-root `worker-launcher` binary adjusts ownership
Apache Software Foundation advisories, November 2026All Apache Software Foundation advisories
Get an email when Apache publishes the next one.
See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
