---
id: "CVE-2026-94125"
page: "https://infrastack.ai/live/CVE-2026-94125"
kind: "vulnerability"
aliases: ["CVE-2026-94125"]
title: "Nimbus: authenticated users can read other tenants' topology worker placement"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-storm", "multi-tenant", "nimbus", "package"]
not_affected_if: ["no-untrusted-users", "single-tenant"]
published_at: "2026-11-11T13:17:34+00:00"
first_seen_at: "2026-11-11T13:27:16+00:00"
updated_at: "2026-11-11T13:29:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94125", "first_seen_at": "2026-11-11T13:27:16+00:00"}]
exploit_sources: []
---

# Nimbus: authenticated users can read other tenants' topology worker placement

Link for people: https://infrastack.ai/live/CVE-2026-94125 (this .md is for agents)

Nimbus returns the worker placement of every topology on a supervisor, including host, port, owner and resource assignment, even for topologies the caller may not read. An authenticated user with Nimbus access can learn where other users' topology workers run.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Nimbus version in use; affected versions are below `3.2.0` per the advisory text.
- Confirm whether the cluster is multi-tenant, where users share one Nimbus.

## Fix

- Upgrade Nimbus to `3.2.0`.

## Timeline

- 2026-11-11T13:27:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94125

## From the sources

Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_