CVE-2026-40557
Global TLS Downgrade via Improper SSL Validation in Apache Storm
Publication date: 2026-04-27
Last updated on: 2026-05-05
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | storm_prometheus_reporter | From 2.6.3 (inc) to 2.8.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-40557 is a vulnerability in Apache Storm Prometheus Reporter versions 2.6.3 through 2.8.6 that occurs when the configuration option storm.daemon.metrics.reporter.plugin.prometheus.skip_tls_validation is enabled. This option, intended to skip TLS certificate validation for Prometheus PushGateway HTTPS connections, causes the use of an insecure trust manager that accepts all SSL certificates without validation.
The insecure SSL context created by this trust manager is set globally for the entire JVM process, which means all HTTPS connections within the Storm daemon bypass certificate validation. This includes connections like ZooKeeper, Thrift, Netty, and UI connections.
As a result, the system trusts any certificate, including self-signed, expired, or attacker-generated ones, enabling man-in-the-middle attacks that can compromise cluster state, topology submissions, tuple data, and administrative credentials.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability causes a global TLS security downgrade in Apache Storm when the insecure TLS validation option is enabled, allowing man-in-the-middle attacks that can compromise sensitive data such as cluster state, topology submissions, tuple data, and administrative credentials.
Such a security weakness can lead to unauthorized access and interception of sensitive information, which may violate data protection requirements mandated by common standards and regulations like GDPR and HIPAA that require strong encryption and secure handling of data in transit.
Therefore, if exploited, this vulnerability could negatively impact compliance by exposing protected data to interception and tampering, undermining confidentiality and integrity controls required under these regulations.
How can this vulnerability impact me? :
This vulnerability can have serious security impacts by allowing man-in-the-middle attacks on all TLS-protected communication channels within the Apache Storm daemon.
- Attackers can intercept and manipulate cluster state information.
- Topology submissions and tuple data can be compromised.
- Administrative credentials may be exposed to attackers.
Overall, the vulnerability undermines the integrity and confidentiality of communications within the Storm cluster.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the Apache Storm configuration enables the insecure TLS validation option for the Prometheus reporter. Specifically, verify if the setting storm.daemon.metrics.reporter.plugin.prometheus.skip_tls_validation is set to true in the storm.yaml configuration file.
Additionally, monitoring network traffic for HTTPS connections that accept all certificates without validation could indicate the vulnerability is active, as the JVM-wide SSL context is downgraded.
Suggested commands to detect the vulnerability include:
- Check the storm.yaml configuration for the skip_tls_validation setting: grep -i 'skip_tls_validation' /path/to/storm.yaml
- Inspect running JVM processes for usage of SSLContext.setDefault calls or insecure trust managers (requires JVM debugging or logging).
- Use network analysis tools (e.g., Wireshark or tcpdump) to capture TLS traffic and verify if certificate validation is being bypassed.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Apache Storm to version 2.8.7 or later where the issue is resolved.
If an immediate upgrade is not possible, remove or disable the configuration setting storm.daemon.metrics.reporter.plugin.prometheus.skip_tls_validation: true from your storm.yaml file.
Instead of skipping TLS validation, configure a proper truststore containing the Prometheus PushGateway's certificate to ensure secure TLS validation.