PT-2026-145214
CVE-2026-94125
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Apache Storm versions prior to 3.2.0
Description
Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner, and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user with access to Nimbus can discover the location of workers belonging to other users' topologies.
Recommendations
Upgrade to version 3.2.0.
Found an issue in the description? Have something to add? Feel free to write us 👾