Improper TLS Client Authentication Management in Apache Storm by Apache Software Foundation

CVE-2026-41081

What is CVE-2026-41081?

Apache Storm, when configured with TLS transport but without mandatory client certificate authentication, may assign an anonymous principal identity (CN=ANONYMOUS) to clients without presenting a valid certificate. This occurs due to the mishandling of SSLPeerUnverifiedException and poses risks of unauthorized access to Storm services if the authorizer does not explicitly deny access. The event is logged at a debug level only, which diminishes visibility and increases the likelihood of exploitation. To mitigate, upgrade to version 2.8.7, enforce client certificate authentication, and review ACL configurations to prevent default-allow behaviors.

References