Improper Access Control in Apache Storm Daemon Configuration

CVE-2026-82433

What is CVE-2026-82433?

The Apache Storm daemon is vulnerable due to improper access controls that allow unauthorized users to access sensitive configuration data. The getNimbusConf function exposes critical credentials such as keystore and truststore passwords without adequate redaction after a superficial user-level authorization check. Additionally, the UI endpoint /api/v1/cluster/configuration lacks necessary authentication annotations, leading to unauthorized access to full daemon configurations. Users are advised to upgrade to version 3.1.0 or above for improved security, including masking of sensitive values in configurations and mandatory authorization for UI API endpoints. Immediate mitigation strategies include placing the UI behind an authenticating reverse proxy and rotating any exposed authentication tokens.

References