CVE-2026-82440 · Package
NO FIX YET · SEE WHAT TO DO
When the scheduler strategy allowlist is unset, Nimbus instantiates any no-argument class on its classpath when a topology is scheduled. An authenticated submitter can use this to start side-effecting classes such as InProcessZookeeper and exhaust threads, sockets and memory in the Nimbus daemon.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clusters running Apache Storm Nimbus where the scheduler strategy allowlist is not set, so any class on the classpath can be instantiated when a topology is submitted. Only authenticated submitters can trigger it. Clusters with an explicit allowlist, or those that cannot submit topologies, are not exposed in the same way.
Not affected if auth-required, explicit-whitelist
Who cares apache-storm, nimbus, self-hosted
storm version; affected versions are those before 3.1.0.nimbus.scheduler.strategy.class.whitelist is set in storm.yaml or the Nimbus configuration; if it is unset, the cluster is in the shipped state the advisory describes.3.1.0, where an unset allowlist means the strategies shipped with Storm.nimbus.scheduler.strategy.class.whitelist explicitly to the strategies intended to be permitted.Description
Nimbus instantiates the class named by a topology's topology.scheduler.strategy when scheduling it. The
allowlist intended to constrain that choice, nimbus.scheduler.strategy.class.whitelist, was treated as
"allow any class" when unset, and it had no entry in the shipped defaults.yaml, so unset was the shipped
state. An authenticated submitter could therefore cause Nimbus to instantiate any class on the Nimbus
classpath that has a no-argument constructor.
Storm's own production artifacts contain classes with side effects suitable for this: instantiating
org.apache.storm.testing.InProcessZookeeper starts a ZooKeeper server with its own threads and sockets
and nothing closes it, and org.apache.storm.LocalCluster behaves similarly. Repeated submissions
therefore consume threads, sockets and memory in the most privileged daemon in the cluster.
Mitigation
Upgrade to 3.1.0, where an unset allowlist means the strategies shipped with Storm rather than any class.
Note that this is a behaviour change: a cluster running an out-of-tree scheduler strategy without an
explicit allowlist will have those topologies refused until the class is added to
nimbus.scheduler.strategy.class.whitelist. The rejection message names the refused class and the
configuration key.
Users who cannot upgrade immediately should set nimbus.scheduler.strategy.class.whitelist explicitly to
the strategies they intend to permit.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.