The ASF using Claude Agents

Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist

Apache Storm Client: Deserialization of Untrusted Data from the State Store

Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder