CVE-2026-82433
Deferred Deferred - Pending Action

Sensitive Data Exposure in Apache Storm Configuration

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description
Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes `storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration. The project masks passwords elsewhere before display, so the omission here is inconsistent rather than intended. The UI endpoint `/api/v1/cluster/configuration` compounded this. It carried no `@AuthNimbusOp` annotation, and the authorization filter treated a missing annotation as "no gate required" and returned immediately, so the endpoint applied no per-user check at all and proxied the request under the UI daemon's own principal. Any user able to pass `ui.filter` therefore received the full configuration, including principals that Nimbus itself would have refused.  Mitigation Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and where every UI API endpoint must declare its authorization explicitly. Users who cannot upgrade immediately should place the UI behind an authenticating reverse proxy that restricts `/api/v1/cluster/configuration`, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through it. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-82433
EUVD
EUVD-2026-77524

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apache storm 3.1.0
apache storm to 3.1.0 (exc)
apache storm From 3.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Storm allows unauthorized users to access sensitive configuration details including passwords for Thrift, Netty, ZooKeeper TLS, and the storm.zookeeper.auth.payload. The issue occurs because the getNimbusConf function returns unredacted configuration after minimal authorization checks, and the /api/v1/cluster/configuration endpoint lacks proper authorization entirely.

Detection Guidance

Check if the `/api/v1/cluster/configuration` endpoint is accessible without authentication. Use curl to query the endpoint: curl http://<storm-ui-host>:<port>/api/v1/cluster/configuration. If it returns full configuration including passwords, the system is vulnerable.

Impact Analysis

Attackers could gain access to cluster credentials, potentially allowing them to take control of the Storm cluster, intercept communications, or access sensitive data processed by the system. Unauthorized access to TLS keystore and truststore passwords could enable man-in-the-middle attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations, regulatory fines, and reputational damage if exploited.

Mitigation Strategies

Upgrade to Apache Storm 3.1.0 or later. If upgrading is not possible, restrict access to the UI endpoint using an authenticating reverse proxy and rotate all exposed credentials including ZooKeeper authentication payload and TLS keystore/truststore passwords.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82433. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart