Nimbus instantiates the class specified by a topology’s `topology.scheduler.strategy`. The allowlist controlling this behavior, `nimbus.scheduler.strategy.class.whitelist`, defaults to permitting any class when unset, allowing an authenticated submitter to cause Nimbus to instantiate arbitrary classes on the Nimbus classpath that have a no‑argument constructor. Malicious or unintended classes such as `org.apache.storm.testing.InProcessZookeeper` or `org.apache.storm.LocalCluster` can start services, consume sockets, threads, and memory, and do not shut down, resulting in code execution and potential denial‑of‑service at the cluster level.

Apache Software Foundation – Apache Storm Nimbus. Any deployment that has not been updated to at least version 3.1.0 and lacks an explicit `nimbus.scheduler.strategy.class.whitelist` is vulnerable. The fix in 3.1.0 changes the default behaviour so that an unset allowlist permits only the built‑in scheduling strategies shipped with Storm.

The vulnerability does not have an EPSS score or KEV listing, but the CVSS score is not provided. Because the attacker requires the ability to submit topologies, the threat is confined to authenticated submitters who have privileged access to the cluster. However, once a malicious strategy class is instantiated, code runs with the Nimbus daemon’s privileges, leading to remote code execution and resource exhaustion. The exploit is straightforward for a legitimate user with topology‑submission rights, making this a high‑risk vulnerability in environments where topology submissions are not tightly controlled.