The ASF using Claude Agents

Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC

Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher