CVE-2026-82440

Description Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it.

Description Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it. The allowlist intended to constrain that choice, `nimbus.scheduler.strategy.class.whitelist`, was treated as "allow any class" when unset, and it had no entry in the shipped `defaults.yaml`, so unset was the shipped state. An authenticated submitter could therefore cause Nimbus to instantiate any class on the Nimbus classpath that has a no-argument constructor…

9. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-82440