CVE-2026-82433
MediumCVSS 6.5Summary
In Apache Storm before 3.1.0, the getNimbusConf function returns full configuration without redaction, and the UI endpoint /api/v1/cluster/configuration lacks proper authorization, potentially exposing passwords and keys.
Risk Assessment
Risk of disclosure of sensitive credentials (e.g., ZooKeeper, TLS) to a potential attacker.
Recommendation
Upgrade to 3.1.0, restrict access to the endpoint, and rotate any exposed passwords.
Other vulnerabilities in Apache Storm
See all- CVE-2026-82432High
In Apache Storm before 3.1.0, the rebalance operation does not revalidate the blobstore map for permissions, and listBlobs lacks authorization checks, allowing an authorized user to access disallowed blobs and disclose metadata.
- CVE-2026-82428High
This vulnerability in Apache Storm affects the `storm jar --artifacts` feature, where dependency artifacts are stored under a blob key derived solely from the Maven coordinate, making it predictable and shared across all users. If the blob already exists, it is silently reused without owner verification, allowing an attacker to control the data that other submitters receive, leading to code execution in another tenant's topology.
- CVE-2026-82427High
A vulnerability in Apache Storm allows an attacker to use relative path segments (../) in the `topology.blobstore.map` to force deletion and symlink creation at arbitrary locations, acting as the supervisor user. This can lead to recursive deletion of data and replacement of symlinks, which when workers are launched enables execution of attacker-chosen code as another tenant's OS user, breaking isolation.
- CVE-2026-82426Medium
A vulnerability in Apache Storm allows an authenticated user with topology submission rights to specify any server-side path as the topology jar, bypassing the intended file upload flow. Nimbus opens the path without verifying it was uploaded, enabling access to files readable by the Nimbus daemon user.
- CVE-2026-84179Medium
Vulnerability in Apache Storm allows unauthorized users to read credential data (e.g., storm.zookeeper.auth.payload, keystore/truststore passwords) via the topology API, because Nimbus daemon configuration is merged with topology configuration and returned without redaction.
- CVE-2014-0115High
Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.
- CVE-2026-82435Critical
In Apache Storm before 3.1.0, a vulnerability exists: the Netty decoder is installed before authentication and processes frames without verification, allowing an unauthenticated attacker to allocate large buffers and potentially cause memory pressure on workers.
- CVE-2026-82439Critical
The DRPC server in Apache Storm keeps a map from function names to request queues, and entries are never removed. An attacker can send arbitrary function names without authentication (as `drpc.authorizer` is disabled by default), leading to unbounded memory growth and eventual heap exhaustion.
- CVE-2015-3188Critical
The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.
Original NVD description (English source)
Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes `storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration. The project masks passwords elsewhere before display, so the omission here is inconsistent rather than intended. The UI endpoint `/api/v1/cluster/configuration` compounded this. It carried no `@AuthNimbusOp` annotation, and the authorization filter treated a missing annotation as "no gate required" and returned immediately, so the endpoint applied no per-user check at all and proxied the request under the UI daemon's own principal. Any user able to pass `ui.filter` therefore received the full configuration, including principals that Nimbus itself would have refused. Mitigation Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and where every UI API endpoint must declare its authorization explicitly. Users who cannot upgrade immediately should place the UI behind an authenticating reverse proxy that restricts `/api/v1/cluster/configuration`, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through it. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.