Authorization Flaw in Apache Storm Allows Exposure of Sensitive Configuration Data

CVE-2026-84179

What is CVE-2026-84179?

A vulnerability in Apache Storm relates to the handling of sensitive configuration data within the topology's information. The 'getTopologyPageInfo' operation merges the Nimbus daemon configuration with topology settings and returns this unredacted in the 'topology_conf' field. This results in exposure of sensitive data such as Zookeeper authentication payloads, keystore, truststore passwords, and other secret keys. If cluster permissions are misconfigured, unauthorized users listed in 'topology.readonly.users' or 'topology.readonly.groups' can gain access to this sensitive information. To mitigate the risk, upgrade to version 3.1.0 where sensitive values are masked. For immediate mitigation, remove any untrusted principals from relevant user groups and rotate all exposed credentials.

References