{"id":"CVE-2026-94125","kind":"vulnerability","aliases":["CVE-2026-94125"],"related":[],"title":"Nimbus: authenticated users can read other tenants' topology worker placement","description":"Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue.","summary":"Nimbus returns the worker placement of every topology on a supervisor, including host, port, owner and resource assignment, even for topologies the caller may not read. An authenticated user with Nimbus access can learn where other users' topology workers run.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-storm","multi-tenant","nimbus","package"],"not_affected_if":["no-untrusted-users","single-tenant"],"how_to_check":"- Check the Nimbus version in use; affected versions are below `3.2.0` per the advisory text.\n- Confirm whether the cluster is multi-tenant, where users share one Nimbus.","fix":"- Upgrade Nimbus to `3.2.0`.","status":"open","published_at":"2026-11-11T13:17:34+00:00","first_seen_at":"2026-11-11T13:27:16+00:00","triaged_at":"2026-11-11T13:29:59+00:00","updated_at":"2026-11-11T13:29:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T13:29:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Nimbus to `3.2.0`.","reach":"network","title":"Nimbus: authenticated users can read other tenants' topology worker placement","impact":"low","summary":"Nimbus returns the worker placement of every topology on a supervisor, including host, port, owner and resource assignment, even for topologies the caller may not read. An authenticated user with Nimbus access can learn where other users' topology workers run.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nimbus","apache-storm","multi-tenant"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"other users' topology placement and owner details exposed to authenticated users","analyst_note":"Confirm the exact affected version range and whether the NVD entry or the Nimbus project advisory lists more detail; the sources only say to upgrade to 3.2.0.","how_to_check":"- Check the Nimbus version in use; affected versions are below `3.2.0` per the advisory text.\n- Confirm whether the cluster is multi-tenant, where users share one Nimbus.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-tenant","no-untrusted-users"],"who_is_affected":"Clusters running Nimbus where several users or tenants submit topologies to the same Nimbus and any of them holds valid Nimbus access. Single-tenant clusters, or clusters where only trusted operators can reach Nimbus, are less exposed. The sources do not list the exact affected version range beyond the recommendation to upgrade to 3.2.0.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00075,"input_tokens":4569,"output_tokens":586,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-94125':13A,16A '3.2.0':126C 'access':56B,107C 'allow':105C 'apach':18B 'apache-storm':17B 'assign':42B,84C 'authent':2A,52B,101C 'author':91C 'caller':47B,88C 'cluster':99C 'cve':11A,14A 'even':43B 'everi':31B,71C 'fix':128C 'host':37B,79C 'includ':36B,77C 'issu':130C 'learn':58B,110C 'may':48B 'multi':21B,97C 'multi-ten':20B,96C 'nimbus':1A,23B,25B,55B,65C,108C 'owner':39B,81C 'packag':24B 'placement':10A,29B,69C 'port':38B,80C 'read':5A,50B,93C 'recommend':121C 'resourc':41B,83C 'return':26B,66C 'run':64B,73C,118C 'storm':19B 'supervisor':35B,76C 'tenant':7A,22B,98C 'topolog':8A,32B,45B,62B,72C,86C,117C 'upgrad':123C 'user':3A,53B,61B,102C,116C,119C 'version':125C 'worker':9A,28B,63B,68C,113C","nicknames":[],"mitigations":[],"who_affected":"Clusters running Nimbus where several users or tenants submit topologies to the same Nimbus and any of them holds valid Nimbus access. Single-tenant clusters, or clusters where only trusted operators can reach Nimbus, are less exposed. The sources do not list the exact affected version range beyond the recommendation to upgrade to 3.2.0.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachestorm","medium","multitenant","nimbus","package"],"campaign_type":null,"search_a":"'-2026':12A,15A '-94125':13A,16A 'authent':2A 'cve':11A,14A 'nimbus':1A 'placement':10A 'read':5A 'tenant':7A 'topolog':8A 'user':3A 'worker':9A","search_b":"'access':56B 'apach':18B 'apache-storm':17B 'assign':42B 'authent':52B 'caller':47B 'even':43B 'everi':31B 'host':37B 'includ':36B 'learn':58B 'may':48B 'multi':21B 'multi-ten':20B 'nimbus':23B,25B,55B 'owner':39B 'packag':24B 'placement':29B 'port':38B 'read':50B 'resourc':41B 'return':26B 'run':64B 'storm':19B 'supervisor':35B 'tenant':22B 'topolog':32B,45B,62B 'user':53B,61B 'worker':28B,63B","search_c":"'3.2.0':126C 'access':107C 'allow':105C 'assign':84C 'authent':101C 'author':91C 'caller':88C 'cluster':99C 'everi':71C 'fix':128C 'host':79C 'includ':77C 'issu':130C 'learn':110C 'multi':97C 'multi-ten':96C 'nimbus':65C,108C 'owner':81C 'placement':69C 'port':80C 'read':93C 'recommend':121C 'resourc':83C 'return':66C 'run':73C,118C 'supervisor':76C 'tenant':98C 'topolog':72C,86C,117C 'upgrad':123C 'user':102C,116C,119C 'version':125C 'worker':68C,113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94125","severity":null,"published_at":"2026-11-11T13:17:34+00:00","modified_at":"2026-11-11T13:17:34+00:00","first_seen_at":"2026-11-11T13:27:16+00:00","fetched_at":"2026-11-11T13:27:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}