CVE-2026-82431: Apache Storm Auth Bypass Vulnerability

CVE-2026-82431 Overview

CVE-2026-82431 is an authorization bypass in Apache Storm's SimpleACLAuthorizer. The authorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. Operators who restricted cluster access by group alone, leaving nimbus.users unset, received no restriction at all. Every authenticated principal was permitted every user-level operation, including submitTopology, beginFileUpload, and getNimbusConf. The failure is silent, with nothing in logs or configuration indicating that the group list is being ignored. The docs/SECURITY.md file presents nimbus.groups as a supported way to lock down a cluster, so deployments following the documentation could believe they were restricted while they were not.

Critical Impact
Any authenticated principal can invoke privileged Nimbus operations such as submitTopology and getNimbusConf on clusters relying solely on nimbus.groups for access control.

Affected Products

Apache Storm versions prior to 3.1.0
Deployments using SimpleACLAuthorizer with nimbus.groups configured and nimbus.users empty
Nimbus clients relying on group-based ACLs for cluster access restriction

Discovery Timeline

2026-09-14 - CVE-2026-82431 published to NVD
2026-09-14 - Last updated in NVD database
Credit: The Apache Software Foundation, found using Claude agents to study open-source project security, validated and reported by Apache Storm

Technical Details for CVE-2026-82431

Vulnerability Analysis

CVE-2026-82431 is an authorization bypass classified as [CWE-863] Incorrect Authorization. The SimpleACLAuthorizer component in Apache Storm evaluates access control lists (ACLs) for Nimbus, the master coordination service. The authorizer supports two configuration properties: nimbus.users for principal-based restrictions and nimbus.groups for group-based restrictions.

The authorization logic contained a short-circuit evaluation flaw. When nimbus.users was empty, the authorizer returned early with a permissive result, never reaching the code path that consulted nimbus.groups. This defeated the group-based restriction entirely on any cluster that used groups as the sole access control mechanism.

The impact spans confidentiality, integrity, and availability. An authenticated principal outside the intended groups can call submitTopology to run arbitrary code on worker nodes, beginFileUpload to write files to the cluster, and getNimbusConf to read Nimbus configuration including credentials.

Root Cause

The root cause is an ordering defect in SimpleACLAuthorizer's user-level command set evaluation. The method returned before combining the user list with the group list, so an empty user list was treated as "no restriction" rather than "consult the group list next." Both lists left empty continues to mean no restriction is configured, which is the shipped default and remains unchanged.

Attack Vector

Exploitation requires only an authenticated principal. Because the failure is silent, operators following the official docs/SECURITY.md guidance for group-based lockdown had no indication their cluster was open. An attacker who obtains any valid Kerberos or authentication credential for the cluster can invoke every user-level Nimbus RPC. Refer to the Apache Mailing List Thread and the OpenWall OSS-Security Update for the maintainer disclosure.

No public proof-of-concept code has been published. The vulnerability is described in prose only in the upstream advisory.

Detection Methods for CVE-2026-82431

Indicators of Compromise

Nimbus access log entries showing submitTopology, beginFileUpload, or getNimbusConf calls from principals outside the groups listed in nimbus.groups
Unexpected topology submissions or file uploads from service accounts not present in the intended group membership
Unexplained reads of Nimbus configuration by principals that should have been denied

Detection Strategies

Audit the running Storm configuration for clusters where nimbus.groups is populated but nimbus.users is empty; these deployments are exposed on affected versions
Correlate authenticated principals in Nimbus logs against expected group membership resolved from the underlying group mapping service
Alert on invocation of privileged Nimbus operations by any principal not on an approved allowlist

Monitoring Recommendations

Enable and centralize Nimbus access logs, forwarding them to a security data lake for retention and search
Track baseline rates of submitTopology and beginFileUpload calls and alert on deviations
Monitor for new or unexpected topologies appearing in the cluster, particularly those executing outbound network activity or spawning shells

How to Mitigate CVE-2026-82431

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0, where nimbus.groups is evaluated whether or not nimbus.users is set
Review Nimbus access logs for operations performed by principals outside the intended groups since group-based ACLs were configured
Inventory all Storm clusters and identify those using nimbus.groups alone; treat them as unrestricted until patched or worked around

Patch Information

Upgrade to Apache Storm 3.1.0. After upgrading, a cluster configured with nimbus.groups alone becomes restrictive for the first time. This includes NimbusClient, which calls getLeader on every connection, so clients outside the configured groups will begin to be refused. Validate that all legitimate clients and service accounts are members of the configured groups before deploying the upgrade to production.

Workarounds

Populate nimbus.users with the intended principals; a non-empty user list causes the group list to be evaluated on affected versions
Restrict network access to the Nimbus RPC port to trusted hosts using firewall rules or network policies until the upgrade is complete
Rotate any credentials or secrets that may have been readable via getNimbusConf during the exposure window

bash

# Configuration example: storm.yaml workaround for affected versions
# Populating nimbus.users forces evaluation of nimbus.groups
nimbus.users:
  - "storm-admin@EXAMPLE.COM"
nimbus.groups:
  - "storm-operators"