# CVE-2026-82440: Apache Storm arbitrary class instantiation in scheduler

Source: https://junglewise.ai/threats/cve-2026-82440-description-nimbus-instantiates-the-class-named-by-a-topology-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-82440 · Severity: info · Published 2026-11-09

Apache Storm is a distributed stream processing system used for real-time data analytics. A configuration flaw allows authenticated users to instantiate arbitrary Java classes during topology scheduling, leading to uncontrolled resource consumption (threads, sockets, memory) on the Nimbus daemon—the most privileged component in a Storm cluster.

Technologies: [Apache Storm](https://junglewise.ai/threats/technologies/storm). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82440 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82440 being exploited in the wild.

**How severe is CVE-2026-82440?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Apache Storm prior to 3.1.0.

**Is there a fix for CVE-2026-82440?** Yes: fixed in 3.1.0. Until then: Set `nimbus.scheduler.strategy.class.whitelist` explicitly to specify only the scheduler strategies that should be permitted until an upgrade to 3.1.0 is possible. Note that doing so will reject any out-of-tree scheduler strategies unless they are explicitly added to this allowlist. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82440 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82440?** Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.1.0

Set `nimbus.scheduler.strategy.class.whitelist` explicitly to specify only the scheduler strategies that should be permitted until an upgrade to 3.1.0 is possible. Note that doing so will reject any out-of-tree scheduler strategies unless they are explicitly added to this allowlist.

## Technical details

The `topology.scheduler.strategy` configuration parameter triggers class instantiation without proper allowlist validation; the shipped default for `nimbus.scheduler.strategy.class.whitelist` is unset, treating this as "allow any class". An authenticated topology submitter can specify a malicious class with a no-argument constructor from the Nimbus classpath to be instantiated, such as `org.apache.storm.testing.InProcessZookeeper` or `org.apache.storm.LocalCluster`, which spawn threads and sockets that are never closed, enabling denial of service through resource exhaustion.

## Affected products

- Apache Storm prior to 3.1.0

## Timeline

- 2026-11-09: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/hxcyk1vg9qx8bzos8g3kx91nz8d23jgt](https://lists.apache.org/thread.html/hxcyk1vg9qx8bzos8g3kx91nz8d23jgt)

## Related threats

- [Apache Storm Nimbus information disclosure in worker placement](https://junglewise.ai/threats/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on)
- [Apache Storm Logviewer symlink traversal in worker logs](https://junglewise.ai/threats/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves)
- [Apache Storm unsafe deserialization in state serialization](https://junglewise.ai/threats/cve-2026-82436-description-defaultstateserializer-used-to-persist-and-restore)
- [Apache Storm CORS misconfiguration allows credential-based data exposure](https://junglewise.ai/threats/cve-2026-82438-apache-storm-cors-misconfiguration-allows-credential-based-data)
- [Apache Storm Logviewer access control bypass in daemon logs](https://junglewise.ai/threats/cve-2026-82437-apache-storm-logviewer-access-control-bypass-in-daemon-logs)