# CVE-2026-82440: Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist

Status: published. Published: 2026-11-09. Updated: 2026-11-09.

Description

Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it. The
allowlist intended to constrain that choice, `nimbus.scheduler.strategy.class.whitelist`, was treated as
"allow any class" when unset, and it had no entry in the shipped `defaults.yaml`, so unset was the shipped
state. An authenticated submitter could therefore cause Nimbus to instantiate any class on the Nimbus
classpath that has a no-argument constructor.

Storm's own production artifacts contain classes with side effects suitable for this: instantiating
`org.apache.storm.testing.InProcessZookeeper` starts a ZooKeeper server with its own threads and sockets
and nothing closes it, and `org.apache.storm.LocalCluster` behaves similarly. Repeated submissions
therefore consume threads, sockets and memory in the most privileged daemon in the cluster.

Mitigation

Upgrade to 3.1.0, where an unset allowlist means the strategies shipped with Storm rather than any class.

Note that this is a behaviour change: a cluster running an out-of-tree scheduler strategy without an
explicit allowlist will have those topologies refused until the class is added to
`nimbus.scheduler.strategy.class.whitelist`. The rejection message names the refused class and the
configuration key.

Users who cannot upgrade immediately should set `nimbus.scheduler.strategy.class.whitelist` explicitly to
the strategies they intend to permit.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Apache Software Foundation / Apache Storm Nimbus (org.apache.storm:storm-client): ≥ 3.0.0; < 3.1.0 (affected, semver). Source: CNA: apache

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-470

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://lists.apache.org/thread.html/hxcyk1vg9qx8bzos8g3kx91nz8d23jgt (CNA: apache; vendor-advisory)

- http://www.openwall.com/lists/oss-security/2026/11/09/2 (ADP: CVE)

- https://lists.apache.org/thread.html/hxcyk1vg9qx8bzos8g3kx91nz8d23jgt (security@apache.org)

- http://www.openwall.com/lists/oss-security/2026/11/09/2 (af854a3a-2127-422b-91ae-364da2661108)

## Provenance

- CNA: apache: https://www.cve.org/CVERecord?id=CVE-2026-82440; retrieved 2026-11-09; source updated 2026-11-09

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82440; retrieved 2026-11-09; source updated 2026-11-09

Revision: 2a2412d4193bc78399d70c329cfc5d6e8768b0ee4348884f8bc1774224fbebd4

Canonical: https://y2.dev/cve/CVE-2026-82440

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.