CVE-2026-82440: Description Nimbus instantiates the class named by a topology's topology.scheduler.strategy when
Source GCVE Database
Not known to be exploited : upgrade to 3.1.0 soon.
Data as of 9 Nov 2026, 13:18 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- Available – fixed in 3.1.0
Exploitation evidence
Disclosed: evidence found.
CVE published 9 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 9 Nov 2026.
What to do
Upgrade Apache Storm Nimbus and org.apache.storm/storm-client to 3.1.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Apache Storm Nimbusorg.apache.storm:storm-client | Affected
| Fixed in
|
Mavenorg.apache.storm/storm-clientpkg:maven/org.apache.storm/storm-clientOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to Apache Storm version 3.1.0 or later, where the default behavior restricts instantiation to only built-in scheduler strategies when the allowlist is unset. For users unable to upgrade immediately, explicitly set the 'nimbus.scheduler.strategy.class.whitelist' configuration to include only the intended scheduler strategy classes. Note that clusters using out-of-tree scheduler strategies must add those classes to the whitelist or their topologies will be rejected with an informative error message.
Description
Nimbus in Apache Storm instantiates a class specified by a topology's scheduler strategy configuration. The intended allowlist to restrict which classes can be instantiated was unset by default, effectively allowing any class on the Nimbus classpath with a no-argument constructor to be instantiated. This allows an authenticated submitter to cause Nimbus to instantiate classes with side effects, such as starting additional ZooKeeper servers or local clusters, leading to resource exhaustion in the Nimbus daemon. The issue is fixed in Apache Storm 3.1.0 by changing the default behavior to only allow built-in strategies when the allowlist is unset. Clusters using out-of-tree scheduler strategies must explicitly whitelist those classes or face rejection of the topologies.