Apache Storm Nimbus CVE-2026-82440

Requires an authenticated submitter who can submit topologies to Nimbus and set topology.scheduler.strategy. The cluster must have nimbus.scheduler.strategy.class.whitelist unset - which is the shipped default for 3.0.0 through 3.0.x because the key is absent from defaults.yaml - causing the allowlist to fail open to 'allow any class'. The abusable classes must be present on the Nimbus classpath with a no-argument constructor; the advisory confirms Storm's own production artifacts (org.apache.storm.testing.InProcessZookeeper, org.apache.storm.LocalCluster) qualify. Limiting factors: exploitation needs valid submission credentials (not remote-unauthenticated), is confined to versions 3.0.0-3.0.x, and is neutralized if an operator has explicitly set the allowlist or upgraded to 3.1.0 (where unset means only Storm-shipped strategies).

This is a moderate-severity denial-of-service / unexpected-class-instantiation flaw in Apache Storm Nimbus, and the available decision signals are thin: there is no CVSS vector, no EPSS score, no KEV listing, and no public exploit identified at time of analysis, with the vuln.today Decision label set to 'awaiting_data'. Exploitation is not remote-unauthenticated: the vendor states an authenticated topology submitter is required, so this is an insider / compromised-credential risk rather than an internet-wide spray target. The core issue is a fail-open allowlist - nimbus.scheduler.strategy.class.whitelist was treated as 'allow any class' when unset, and it had no entry in the shipped defaults.yaml, making the vulnerable state the default-shipped state, which materially raises exposure among affected 3.0.x deployments. The realistic impact is bounded to availability: repeated submissions instantiate side-effecting classes already on the Nimbus classpath (e.g. org.apache.storm.testing.InProcessZookeeper, org.apache.storm.LocalCluster) that spawn threads/sockets and are never closed, exhausting resources in the cluster's most privileged daemon. The description does not claim remote code execution or data exposure, so despite 'arbitrary class instantiation' language this should be read as a resource-exhaustion DoS, not an RCE; broader abuse is limited to no-argument-constructor classes present on the classpath. Net: a genuine priority for multi-tenant Storm clusters where submission rights are widely held, but lower urgency for single-tenant/trusted-operator deployments. Severity and EPSS/KEV correlation cannot be cross-checked because no CVSS vector or EPSS value was supplied - the moderate rating is the vendor's.

An authenticated user with topology-submission rights on a Storm 3.0.x cluster (shipped default: no allowlist) submits topologies whose topology.scheduler.strategy names a side-effecting classpath class such as InProcessZookeeper or LocalCluster. Nimbus instantiates each one via its no-argument constructor, starting threads and sockets that are never cleaned up; repeating the submission steadily consumes threads, sockets and memory in the Nimbus daemon until it degrades or fails. No public exploit identified at time of analysis, though the technique is fully described by the vendor advisory.