Apache Software Foundation Apache Storm Ui vulnerabilities

CVE-2026-82433 [MEDIUM] CWE-522 CVE-2026-82433: Description `getNimbusConf` returned the complete daemon configuration without redaction after only Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes `storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration. The project masks passw

CVE-2026-84179 [MEDIUM] CWE-200 CVE-2026-84179: Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own co Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/{id} and of the corresponding metrics endpoint. Where the cl

CVE-2026-35565 [MEDIUM] CWE-79 CVE-2026-35565: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Af Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The Storm UI visualization component interpolates topology metadata including component IDs, stream names, and grouping values directly into HTML via innerHTML in parseNode() and parseEdge() without sanitization at any