Apache Software Foundation Apache Storm Client

• CVE-2026-82428 High 8.8 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys 0.7%
• CVE-2026-82431 Critical 9.8 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users 0.4%
• CVE-2026-82434 Medium 6.5 Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs 0.5%
• CVE-2026-41081 Medium 6.5 Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure 0.3%
• CVE-2026-35337 High 8.8 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling 1.0%