CVE-2026-82440: Apache Storm arbitrary class instantiation in scheduler

CVE-2026-82440 · Severity: info · Published 2026-11-09

Apache Storm is a distributed stream processing system used for real-time data analytics. A configuration flaw allows authenticated users to instantiate arbitrary Java classes during topology scheduling, leading to uncontrolled resource consumption (threads, sockets, memory) on the Nimbus daemon—the most privileged component in a Storm cluster.

Technologies: Apache Storm. Vendors: Apache.

Quick answers

Is CVE-2026-82440 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82440 being exploited in the wild.
How severe is CVE-2026-82440?
Informational severity, published 9 November 2026.
Which products and versions are affected?
Apache Storm prior to 3.1.0.
Is there a fix for CVE-2026-82440?
Yes: fixed in 3.1.0. Until then: Set `nimbus.scheduler.strategy.class.whitelist` explicitly to specify only the scheduler strategies that should be permitted until an upgrade to 3.1.0 is possible. Note that doing so will reject any out-of-tree scheduler strategies unless they are explicitly added to this allowlist. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82440 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-82440?
Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.1.0

Set `nimbus.scheduler.strategy.class.whitelist` explicitly to specify only the scheduler strategies that should be permitted until an upgrade to 3.1.0 is possible. Note that doing so will reject any out-of-tree scheduler strategies unless they are explicitly added to this allowlist.

Technical details

The `topology.scheduler.strategy` configuration parameter triggers class instantiation without proper allowlist validation; the shipped default for `nimbus.scheduler.strategy.class.whitelist` is unset, treating this as "allow any class". An authenticated topology submitter can specify a malicious class with a no-argument constructor from the Nimbus classpath to be instantiated, such as `org.apache.storm.testing.InProcessZookeeper` or `org.apache.storm.LocalCluster`, which spawn threads and sockets that are never closed, enabling denial of service through resource exhaustion.

Affected products

  • Apache Storm prior to 3.1.0

Timeline

  • 2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.