CVE-2026-82434: Apache Storm Information Disclosure Vulnerability

CVE-2026-82434 Overview

Apache Storm exposes ZooKeeper authentication credentials to users holding only read-only topology permissions. When ZooKeeper authentication is configured, Storm retains storm.zookeeper.topology.auth.payload in the topology configuration because workers require it. Nimbus then serves that configuration verbatim to any caller with read-only topology view rights.

The leaked credential is not read-only in effect. The cluster state implementation uses write-capable Access Control Lists (ACLs) for worker heartbeats, backpressure, and error state. A recipient can forge or remove that state for the affected topology. The credential was also logged at INFO by the submission client and at DEBUG by the Simple Authentication and Security Layer (SASL) handlers, reaching log aggregators and support bundles.

Critical Impact
An authenticated user with read-only topology permissions can obtain a write-capable ZooKeeper credential and tamper with worker heartbeats, backpressure, and error state for that topology.

Affected Products

Apache Storm versions prior to 3.1.0 with ZooKeeper authentication configured
Apache Storm Nimbus service serving topology configurations to read-only callers
Apache Storm submission client and SASL handlers writing the payload to logs

Discovery Timeline

2026-09-14 - CVE-2026-82434 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-82434

Vulnerability Analysis

The flaw is a credential exposure issue tracked under CWE-522: Insufficiently Protected Credentials. Storm intentionally keeps storm.zookeeper.topology.auth.payload inside the topology configuration so that workers can authenticate to ZooKeeper. Nimbus does not strip this field before returning topology configuration to callers.

Any principal granted read-only topology permissions therefore receives the ZooKeeper credential associated with that topology. Because the cluster state implementation attaches write-capable ACLs when using this payload for worker heartbeats, backpressure signals, and error reporting, the credential grants more than observability. It grants the ability to inject or remove state on the affected topology paths in ZooKeeper.

The advisory also covers two logging paths that widened exposure. The submission client logged the generated payload at INFO on every submission that generated one. The SASL handlers logged it at DEBUG. Both paths distributed the credential to log aggregation systems and support bundles.

Root Cause

Storm did not distinguish between configuration fields required by workers and configuration fields safe to disclose to read-only clients. Nimbus served the raw configuration map, including the ZooKeeper authentication payload. The logging code paths compounded the disclosure by writing the same secret at INFO and DEBUG levels.

Attack Vector

An authenticated user with the minimum topology read grant queries Nimbus for the topology configuration and extracts storm.zookeeper.topology.auth.payload. The attacker then authenticates directly to ZooKeeper with the payload and modifies worker heartbeat, backpressure, or error state paths for that topology. A secondary vector is passive: any operator with access to retained Storm logs or support bundles can recover the same credential without interacting with Nimbus.

No verified proof-of-concept code has been published. Refer to the Apache mailing list announcement for the vendor description.

Detection Methods for CVE-2026-82434

Indicators of Compromise

Presence of storm.zookeeper.topology.auth.payload values inside archived Storm submission-client logs at INFO level.
Presence of the same payload string inside SASL handler DEBUG logs or support bundles collected from the cluster.
Unexpected modifications, deletions, or forged entries in ZooKeeper paths for worker heartbeats, backpressure, or error state on affected topologies.

Detection Strategies

Grep retained Storm logs and support bundles for the storm.zookeeper.topology.auth.payload key and any credential-shaped values adjacent to it.
Audit ZooKeeper access logs for authentication events using topology payload credentials from principals that only hold read-only Storm grants.
Correlate topology configuration read API calls with subsequent direct ZooKeeper writes originating from the same source addresses.

Monitoring Recommendations

Forward Nimbus, submission client, and SASL handler logs into a centralized analytics platform and alert on the payload key name.
Monitor ZooKeeper ACL usage for the write-capable ACLs tied to worker heartbeat and backpressure znodes.
Track the roster of principals holding topology read permissions and alert on additions that are not tied to trusted operator identities.

How to Mitigate CVE-2026-82434

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0, where Nimbus removes the payload from configurations served to read-only callers and the client and SASL handlers no longer log it.
Rotate storm.zookeeper.topology.auth.payload for every existing topology after upgrading, since previously issued values must be assumed compromised.
Review retained logs, log-aggregation indexes, and support bundles for the payload value and purge or restrict access to matches.

Patch Information

Apache Storm 3.1.0 removes storm.zookeeper.topology.auth.payload from the topology configuration returned to read-only callers and stops writing the payload to submission client INFO logs and SASL handler DEBUG logs. Details are available in the Apache Storm advisory thread and the OpenWall OSS-Security notice.

Workarounds

Restrict read-only topology permissions to a small set of trusted principals until the upgrade is completed.
Rotate the ZooKeeper authentication payload for all topologies and re-issue only to workers that require it.
Lower log retention for submission client and SASL handler logs, or redact the storm.zookeeper.topology.auth.payload key from any aggregated log pipelines.

bash

# Configuration example: redact the payload key from aggregated Storm logs
# (illustrative sed pipeline for pre-upgrade log sanitization)
sed -E 's/(storm\.zookeeper\.topology\.auth\.payload=)[^ ,}]+/\1[REDACTED]/g' \
    /var/log/storm/nimbus.log \
    > /var/log/storm/nimbus.sanitized.log