ZooKeeper Authentication Vulnerability Affecting Apache Storm

CVE-2026-82434

What is CVE-2026-82434?

A configuration exposure vulnerability in Apache Storm occurs when ZooKeeper authentication is enabled, causing sensitive credentials to be revealed to users with read-only topology permissions. This vulnerability arises because Nimbus serves topology configurations verbatim, exposing storm.zookeeper.topology.auth.payload that includes credentials for ZooKeeper access. These credentials are not limited to read-only permissions, allowing malicious actors to potentially manipulate cluster states. Logs generated during submissions and by SASL handlers also include these sensitive credentials. To mitigate this vulnerability, users are advised to upgrade to version 3.1.0 or later, where sensitive payloads are removed from logs and configuration outputs. For immediate action, users should rotate existing credentials and restrict read-only permissions.

References