CVE-2026-94125— Apache Storm: Supervisor page discloses worker placement of other users' topologies
Quick assessment
Affected
Apache Software Foundation Apache Storm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nimbus 会返回运行在 Supervisor 上的所有拓扑的 Worker 部署信息，其中包括主机、端口、所有者以及资源分配详情，即使调用者没有权限读取这些拓扑。在多租户集群中，任何已获准访问 Nimbus 的认证用户均可获取其他用户拓扑的 Worker 运行位置。建议用户升级至 3.2.0 版本，该版本已修复此问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94125
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Storm: Supervisor page discloses worker placement of other users' topologies
Source: CVE Program / CVE List V5
Vulnerability Description
Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Storm | 2.0.0 ~ 3.2.0 | - |
|
II. Public POCs for CVE-2026-94125
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94125
请登录查看更多情报信息。
Other References for CVE-2026-94125 (1)
-
https://lists.apache.org/thread/8of7kv48thj82bb8vqrz6wbglmyldyvv vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-11-11 · 24 CVEs total
| CVE-2026-118411 | 8.8 HIGH | Apache Roller: Cross-site request forgery through GET requests to administrative actions |
| CVE-2026-105153 | 7.7 HIGH | Apache Roller: XML external entity processing in AtomPub entry parsing |
| CVE-2026-105154 | 6.1 MEDIUM | Apache Roller: Cross-site request forgery in Planet administration lets an attacker make t |
| CVE-2026-118414 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting through the weblog description |
| CVE-2026-118413 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting through imported blogroll links |
| CVE-2026-118409 | 5.3 MEDIUM | Apache Roller: Commenter email addresses recoverable through public search |
| CVE-2026-118405 | 4.3 MEDIUM | Apache Roller: Exposure of other users' email addresses through the user search |
| CVE-2026-105152 | 4.3 MEDIUM | Apache Roller: Weblog template access to wrapped objects exposes another user's password h |
| CVE-2026-118410 | 3.7 LOW | Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish |
| CVE-2026-118408 | 3.1 LOW | Apache Roller: Unpublished entries of other weblogs readable through preview |
| CVE-2026-118412 | 3.1 LOW | Apache Roller: Disabled accounts can sign in through OpenID |
| CVE-2026-111824 | Apache Roller: Stored cross-site scripting through custom-theme resource URLs | |
| CVE-2026-122096 | Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted ske | |
| CVE-2026-124495 | Apache Storm: Logviewer follows worker symlinks across topology ACLs | |
| CVE-2026-126627 | Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local | |
| CVE-2026-111792 | Apache XML Graphics Batik: Denial of Service via SVG Element Reference Resolution | |
| CVE-2026-90993 | Apache XML Graphics Batik: Harden validation in SAXDocumentFactory | |
| CVE-2026-124496 | Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer | |
| CVE-2026-108338 | Apache Roller: Stored cross-site scripting through AtomPub entry tags | |
| CVE-2026-49236 | Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource sam |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Storm
-
CVE-2026-124496
Apache Storm: DRPC HTTP doAsUser bypasses the impersonation -
CVE-2026-124495
Apache Storm: Logviewer follows worker symlinks across topol -
CVE-2023-43123
Apache Storm: Local Information Disclosure Vulnerability in -
CVE-2021-40865
Unsafe Pre-Authentication Deserialization In Workers -
CVE-2021-38294
Shell Command Injection Vulnerability in Nimbus Thrift Serve
Same vendor: Apache Software Foundation
-
CVE-2026-49236
Apache XML Graphics Batik: SVG color-profile xml:base bypass -
CVE-2026-40853
Apache XML Graphics Batik: Cross-Site Scripting via Unencode -
CVE-2026-123374
Apache Roller: Deserialization of untrusted data in weblog u -
CVE-2026-122300
Apache Roller: Limited weblog members can remove or change p -
CVE-2026-118414
Apache Roller: Stored cross-site scripting through the weblo
Same weakness: CWE-862
-
CVE-2026-125046
WordPress Create plugin <= 3.1.1 - Broken Access Control vul -
CVE-2026-122300
Apache Roller: Limited weblog members can remove or change p -
CVE-2026-125448
WordPress Kali Forms plugin <= 2.4.31 - Broken Access Contro -
CVE-2026-123481
WordPress The Ultimate WordPress Toolkit – WP Extended plugi -
CVE-2026-125763
WordPress SureForms plugin <= 2.13.0 - Broken Access Control