TL;DR The Apache Software Foundation disclosed 20 security flaws on November 9, 2026. Eighteen affect Apache Airflow, and two affect Apache Storm. These Apache Airflow vulnerabilities range from leaked secrets to code execution on Celery workers. Five of the 20 are rated high severity. Airflow 3.4.0 fixes deserialization, authorization and secret-masking bugs, including one that lets anyone with Celery broker access run code.

TL;DR The Apache Software Foundation addressed seventeen distinct vulnerabilities impacting Apache Storm version 3.0.0. These flaws enable authenticated users to escalate privileges to root, execute arbitrary code, and read sensitive cluster credentials. Administrators must deploy version 3.1.0 immediately to prevent unauthorized access across distributed worker nodes. Why This Threat Matters Industry estimates indicate that thousands of organizations deploy Apache Storm to analyze unbounded data streams in real time.