CVE-2026-82433: Apache Storm Information Disclosure Flaw

CVE-2026-82433 Overview

CVE-2026-82433 is a credential exposure vulnerability in Apache Storm. The getNimbusConf Thrift call returns the full daemon configuration after only a user-level authorization check, without redacting sensitive values. Where the cluster is configured with them, the response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for Thrift, Netty, and ZooKeeper TLS. The UI endpoint /api/v1/cluster/configuration compounds the issue because it carries no @AuthNimbusOp annotation and the authorization filter treats a missing annotation as no gate required. Any authenticated user able to pass ui.filter receives the complete configuration under the UI daemon principal.

Critical Impact
Authenticated users can retrieve ZooKeeper authentication payloads and TLS keystore/truststore passwords, enabling lateral movement into the cluster's trust infrastructure.

Affected Products

Apache Storm versions prior to 3.1.0
Apache Storm Nimbus daemon (getNimbusConf Thrift API)
Apache Storm UI daemon (/api/v1/cluster/configuration endpoint)

Discovery Timeline

2026-09-14 - CVE CVE-2026-82433 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-82433

Vulnerability Analysis

The flaw is a credential exposure issue mapped to [CWE-522] Insufficiently Protected Credentials. Apache Storm masks passwords elsewhere in the codebase before display, so the omission in getNimbusConf is inconsistent with the project's own conventions. The response body returns the full daemon configuration map, including any secrets loaded into it at startup.

The UI endpoint amplifies the exposure. The authorization filter interprets the absence of an @AuthNimbusOp annotation as an open route rather than a closed one. As a result, /api/v1/cluster/configuration performs no per-user check and proxies the request under the UI daemon's own principal. This bypasses the Nimbus-level authorization that would otherwise reject the caller.

Root Cause

Two defects combine. First, getNimbusConf never applies redaction to credential-bearing keys before returning the configuration. Second, the UI authorization filter fails-open when an endpoint declaration is missing an authorization annotation, so any endpoint added without @AuthNimbusOp inherits no access control.

Attack Vector

An attacker who can authenticate to the Storm UI through ui.filter sends a GET request to /api/v1/cluster/configuration. The response contains storm.zookeeper.auth.payload and the TLS keystore and truststore passwords for Thrift, Netty, and ZooKeeper. The attacker then uses the leaked ZooKeeper authentication payload to access cluster coordination data or the TLS material to impersonate cluster components. See the Apache Mailing List Thread for the full advisory.

Detection Methods for CVE-2026-82433

Indicators of Compromise

Unexpected GET requests to /api/v1/cluster/configuration in Storm UI access logs, particularly from non-administrator principals.
Thrift getNimbusConf calls from users who do not operate topologies.
ZooKeeper authentication events or Thrift/Netty TLS handshakes using credentials from unexpected source hosts after UI access.

Detection Strategies

Enable and review Storm UI access logs for requests to configuration endpoints and correlate with the requesting user identity.
Alert on Nimbus Thrift getNimbusConf invocations by principals outside a defined administrator allowlist.
Monitor ZooKeeper and TLS-terminating services for authentication attempts using leaked credentials after suspicious UI activity.

Monitoring Recommendations

Ingest Storm UI, Nimbus, and ZooKeeper logs into a central SIEM and retain them long enough to investigate credential misuse.
Baseline normal access patterns for the Storm UI API and alert on deviations to configuration or administrative endpoints.
Track credential rotation events for ZooKeeper and TLS keystores so post-incident rotation is auditable.

How to Mitigate CVE-2026-82433

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0, where credential-bearing values are masked before the configuration is served and every UI API endpoint must declare its authorization explicitly.
Rotate storm.zookeeper.auth.payload and any Thrift, Netty, and ZooKeeper TLS keystore and truststore passwords that were reachable through the vulnerable endpoints.
Restrict access to the Storm UI to trusted administrative networks until the upgrade is complete.

Patch Information

Apache Storm 3.1.0 remediates both defects. It masks credential-bearing configuration values before returning them from getNimbusConf, and it enforces that every UI API endpoint declare an explicit authorization annotation rather than failing open when one is missing. Details are available in the Openwall OSS-Security Discussion.

Workarounds

Place the Storm UI behind an authenticating reverse proxy and restrict /api/v1/cluster/configuration to administrator identities only.
Tighten ui.filter so that only trusted administrative accounts can authenticate to the UI at all.
Rotate ZooKeeper authentication payloads and TLS keystore/truststore passwords after applying access restrictions, treating any previously reachable secrets as compromised.

bash

# Example nginx reverse proxy restriction for the vulnerable endpoint
location = /api/v1/cluster/configuration {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    auth_basic "Storm Admin";
    auth_basic_user_file /etc/nginx/.htpasswd-storm-admin;
    proxy_pass http://storm-ui-backend;
}