CVE-2026-84179
Deferred Deferred - Pending Action

Information Disclosure in Apache Storm UI

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description
Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/{id} and of the corresponding metrics endpoint. Where the cluster is configured with them, the merged map includes storm.zookeeper.auth.payload, which Storm's own documentation directs operators to keep in storm-cluster-auth.yaml under permissions that deny access from workers, together with the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration, and any plugin key whose name denotes a secret. getTopologyPageInfo is a topology read-only operation. Under SimpleACLAuthorizer a principal listed in topology.readonly.users or topology.readonly.groups could therefore read daemon credentials that the dedicated cluster configuration API, getNimbusConf, redacts and that is gated on nimbus.users instead. The sibling operations that exist to serve configuration were masked; the topology page, which merges in strictly more daemon state, was not. Mitigation Upgrade to 3.1.0, where credential-bearing values are masked before any configuration is served over the Nimbus API. Users who cannot upgrade immediately should remove any principal that is not trusted with cluster credentials from topology.readonly.users, topology.readonly.groups, topology.users and topology.groups, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through the topology page. Credit Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-84179
EUVD
EUVD-2026-77482

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache storm 3.1.0
apache storm to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Apache Storm exposing sensitive credentials through its Nimbus API. The getTopologyPageInfo function merges daemon configuration with topology configuration without redacting sensitive fields like storm.zookeeper.auth.payload, keystore passwords, and TLS credentials. These values are then exposed via the Storm UI and API endpoints to users with topology read-only access, potentially allowing unauthorized access to cluster credentials.

Detection Guidance

Check Apache Storm UI endpoints for exposed sensitive credentials in topology configuration fields. Inspect logs for unauthorized access attempts to topology pages or configuration APIs. Verify user permissions in topology.readonly.users, topology.readonly.groups, topology.users, and topology.groups.

Impact Analysis

If you are an Apache Storm operator, this vulnerability could allow unauthorized users with topology read-only access to steal sensitive cluster credentials. This includes ZooKeeper authentication payloads, TLS keystore and truststore passwords, and plugin secrets. Attackers could use these credentials to gain deeper access to the cluster, compromise data, or disrupt services.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive data and credentials. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. Unauthorized access to cluster credentials could result in data breaches, violating these regulations and potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade to Apache Storm 3.1.0. If immediate upgrade is not possible, remove untrusted principals from topology.readonly.users, topology.readonly.groups, topology.users, and topology.groups. Rotate ZooKeeper authentication payload and TLS keystore or truststore passwords exposed via the topology page.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart