Apache Storm Vulnerabilities by Version: CVEs for Storm 1.2, 2.x and 3.x

The short answer

Storm 3.1.0, released on 12 September 2026, is the only Storm release with every published security fix. It fixed 15 CVEs, all filed against 3.0.0, and its announcement told anyone still on 2.x to treat the same issues as unpatched there, because the 2.x line reached end of life with 2.8.9 on 22 July 2026. Earlier in the year, 2.8.6 and 2.8.7 fixed four CVEs on the 2.x line, among them CVE-2026-35337, a deserialization flaw that lets a user with topology submission rights run code on Nimbus and the workers. The 1.x line has had no release since 1.2.4 in October 2021.

The CVE records for the September batch name 3.0.0 as the affected version and say nothing about 2.x either way. The project's own statement is the one to plan around: a cluster on 2.8.9 should be treated as exposed to the 3.1.0 list, and no 2.x release will fix it.

Storm release lines and their CVEs

Release dates are from the Storm release announcements. Each row lists the CVEs whose ranges include the line, or that the project says to treat as unpatched on it, and that have no fix in its latest release.

The 3.1.0 announcement lists 17 advisories. Two of them had no published CVE record when this was checked on 6 October 2026, so they are left out of this guide. For release dates on every line, see the Apache Storm end-of-life chart.

Notable Storm CVEs on 1.2 and 2.x

CVSS is NVD's own score where NVD has scored the record, otherwise the CVSS 3.1 score CISA-ADP added. None of these CVEs is in CISA's Known Exploited Vulnerabilities catalogue.

The two 2021 CVEs are the most serious on the list because neither needs credentials, only network access to Nimbus or a worker port. CVE-2026-35337 needs topology submission rights, but a cluster that leaves nimbus.users unset grants those to every authenticated principal. CVE-2026-41081 matters where an authorizer does not explicitly deny CN=ANONYMOUS, and CVE-2023-43123 only where ui.disable.spout.lag.monitoring has been set to false, since it is true by default.

The 3.1.0 batch

All 15 CVEs give 3.0.0 as the affected version and 3.1.0 as the fix. NVD has not yet scored them, so the score is CISA-ADP's. Apache, as the CNA, scored CVE-2026-82434 at 10.0 under CVSS 4.0 and rated the others important or moderate.

Read together, the batch is about multi-tenant clusters. Most rows start with a user who can already submit or view a topology and end with that user reading cluster secrets, touching other tenants' topologies or getting root on a supervisor. As the advisory for CVE-2026-82426 points out, a cluster that leaves nimbus.users unset grants submission to every authenticated principal, so the bar is lower than it looks. Three rows need less: CVE-2026-82435 and CVE-2026-82439 need only network access to a worker or DRPC port, and CVE-2026-82431 only a valid credential. Four rows, CVE-2026-82426, CVE-2026-82433, CVE-2026-82434 and CVE-2026-84179, expose the ZooKeeper authentication payload, so the advice in each is to rotate it. The ZooKeeper ensemble under Storm has its own CVE list; see ZooKeeper vulnerabilities by version.

What each line gets

Storm 3.1

3.1.0 carries every fix above. Three of them need more than a server upgrade. The fix for CVE-2026-82428 is in the submitting client, so every machine that runs storm jar --artifacts needs 3.1.0 as well. The worker-launcher must be rebuilt and reinstalled for CVE-2026-82429 and CVE-2026-82430. And a cluster restricted by nimbus.groups alone becomes restrictive for the first time, which will refuse clients outside those groups. JSONP wrapping is also off by default from 3.1.0, behind ui.enable.jsonp.

Storm 3.0

3.0.0 is outside the ranges of the April 2026 CVEs but has all 15 from September. Moving to 3.1.0 keeps the same Java 25 runtime and Java API, so it is a minor upgrade.

Storm 2.8

2.8.6, on 12 April 2026, and 2.8.7, on 25 April, fixed the four 2026 CVEs on 2.x. 2.8.8 and 2.8.9 brought bug fixes and library updates, and 2.8.9 was declared the final 2.x release. The 3.1.0 fixes will not be backported. Moving to 3.x means Java 25 on every Nimbus, supervisor and worker host, and rewriting any Clojure topologies; see upgrading from Storm 2.x to 3.x and Storm 2 end of life.

Storm 2.0 to 2.7

None of these lines has the April 2026 fixes, and the last release of any of them was 2.7.1 in November 2024. 2.0 to 2.5 also lack the CVE-2023-43123 fix from 2.6.0. A cluster still on 2.1.0 or 2.2.0, without 2.1.1 or 2.2.1, is exposed to the two 2021 flaws that need no credentials at all.

Storm 1.2

1.2.4 fixed the 2021 CVEs, and nothing has been released for 1.x since. Whether the April 2026 CVEs reach 1.2 is not settled: Apache's records cover every release before 2.8.6 or 2.8.7, and NVD's analysis starts the range at 2.0.0. Storm 1.2.4 also bundles ZooKeeper 3.4.14, from a ZooKeeper line that has been end of life since 2020; see Storm and ZooKeeper.

What to do on each line

• 3.0. Move to 3.1.0, upgrade every client that uses --artifacts, rebuild the worker-launcher, and rotate the ZooKeeper authentication payloads and TLS store passwords.
• 2.8. Plan the Java 25 move to 3.1, or take patched builds from a supplier that backports fixes. Until then, set nimbus.users explicitly, trim topology.readonly.users and topology.readonly.groups, configure drpc.authorizer, enable storm.messaging.netty.authentication, keep Nimbus, worker and DRPC ports inside the cluster, put the UI and Logviewer behind an authenticating reverse proxy that strips CORS headers and rejects callback parameters, and rotate storm.zookeeper.topology.auth.payload.
• 2.0 to 2.7. 2.8.9 is the only 2.x release with the April 2026 fixes, but it is end of life too, so treat it as a step toward 3.1 or a patched build, not a destination. Apply the 2.8 mitigations in the meantime, and on 2.1.0 or 2.2.0 keep Nimbus and worker ports off every untrusted network.
• 1.2. Plan the move to 3.1 through a supported path, or take patched builds. Patch or replace the ZooKeeper 3.4 ensemble under it at the same time.

Where OSSeva fits

OSSeva ships patched, signed builds of Apache Storm 1.2 and 2.x, including 2.4, 2.6, 2.7 and 2.8, on the Java version you already run and with topologies unchanged. The bundled ZooKeeper and Curator are patched in the same build, along with transitive dependencies such as Netty, Jetty, Jackson and Kryo, delivered as Maven artifacts, Docker images and tarballs with GPG signatures and VEX statements for scanner findings. OSSeva backports fixes of this class to the end-of-life release lines it patches. They are available now on the Patch, Assure and Operate tiers. Assure adds a Nimbus HA, supervisor and ZooKeeper quorum review, an audit of nimbus.users, nimbus.groups and the ZooKeeper credentials, and a topology and dependency inventory against Java 25, and Operate adds 24/7 throughput, latency and back-pressure monitoring with a 15-minute P1 response, a named senior Storm engineer and execution of the Storm 3 and Java 25 migration. See Apache Storm support and Apache Storm extended support.