CVE-2026-84179: Apache Storm Information Disclosure Flaw

CVE-2026-84179 Overview

CVE-2026-84179 is an information disclosure vulnerability in Apache Storm's Nimbus API. The getTopologyPageInfo operation merges the Nimbus daemon configuration with a topology's own configuration and returns the combined map in the topology_conf field of TopologyPageInfo without redaction. The Storm UI copies this value verbatim into the configuration field of GET /api/v1/topology/{id} and the corresponding metrics endpoint. Any authenticated principal listed in topology.readonly.users or topology.readonly.groups under SimpleACLAuthorizer can read daemon credentials that the sibling getNimbusConf API redacts. The issue is tracked as CWE-200: Exposure of Sensitive Information.

Critical Impact
Low-privileged read-only topology users can extract ZooKeeper authentication payloads and TLS keystore or truststore passwords for the Thrift, Netty, and ZooKeeper subsystems.

Affected Products

Apache Storm versions prior to 3.1.0
Storm Nimbus daemon exposing getTopologyPageInfo
Storm UI serving /api/v1/topology/{id} and topology metrics endpoints

Discovery Timeline

2026-09-14 - CVE-2026-84179 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database
Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team

Technical Details for CVE-2026-84179

Vulnerability Analysis

Apache Storm exposes multiple Nimbus operations that return configuration data. The dedicated getNimbusConf API redacts credential-bearing values and is gated on nimbus.users. The getTopologyPageInfo operation, by contrast, is treated as a read-only topology operation and is gated on topology.readonly.users or topology.readonly.groups.

The defect is that getTopologyPageInfo builds its response by merging Nimbus daemon configuration into the topology configuration and returns the merged map through topology_conf without applying the redaction logic used elsewhere. The Storm UI then propagates the raw map to REST callers through GET /api/v1/topology/{id} and the topology metrics endpoint.

Because the operation exposes strictly more daemon state than the sibling configuration endpoints, principals with only topology read permissions gain access to cluster secrets. Storm's own documentation directs operators to keep storm.zookeeper.auth.payload in storm-cluster-auth.yaml under permissions that deny access from workers, which underscores the sensitivity of the leaked material.

Root Cause

The merging of daemon and topology configuration in getTopologyPageInfo was implemented without a redaction pass. The sibling operations that exist to serve configuration were masked, but the topology page path was not. Any key holding a secret value including storm.zookeeper.auth.payload, TLS keystore and truststore passwords, and plugin keys whose names denote a secret is returned in cleartext.

Attack Vector

An attacker authenticates to the Storm cluster as a principal enumerated in topology.readonly.users, topology.readonly.groups, topology.users, or topology.groups. The attacker issues an authenticated GET /api/v1/topology/{id} request against the Storm UI, or invokes getTopologyPageInfo directly against Nimbus. The response's configuration or topology_conf field contains the merged daemon configuration, including ZooKeeper authentication payloads and Thrift, Netty, and ZooKeeper TLS credentials. The vulnerability requires network access and low-privilege authentication only, with no user interaction.

No public exploit code has been published. See the Apache Mailing List Thread and the OpenWall OSS Security Update for the vendor discussion.

Detection Methods for CVE-2026-84179

Indicators of Compromise

Requests to GET /api/v1/topology/{id} or the topology metrics endpoint from principals not previously observed accessing topology pages
Nimbus audit log entries showing getTopologyPageInfo invocations by users listed only in topology.readonly.users or topology.readonly.groups
Subsequent ZooKeeper authentication events using the exposed storm.zookeeper.auth.payload from unexpected source addresses
TLS handshake anomalies to Thrift or Netty endpoints indicating stolen keystore or truststore credentials in use

Detection Strategies

Enable Nimbus request logging and alert on getTopologyPageInfo calls whose response body contains keys matching *.password, *.auth.payload, or *keystore*
Correlate Storm UI access logs with the effective ACL role of the requesting principal to flag read-only users accessing configuration fields
Baseline expected callers of /api/v1/topology/{id} and alert on new principals or unusual request volumes

Monitoring Recommendations

Forward Nimbus, Storm UI, and ZooKeeper logs into a centralized analytics platform for correlation
Monitor ZooKeeper ACL failures that may follow credential rotation or unauthorized reuse of leaked payloads
Track configuration changes to topology.readonly.users, topology.readonly.groups, topology.users, and topology.groups

How to Mitigate CVE-2026-84179

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0, which masks credential-bearing values before any configuration is served over the Nimbus API
Remove any principal not trusted with cluster credentials from topology.readonly.users, topology.readonly.groups, topology.users, and topology.groups
Rotate the storm.zookeeper.auth.payload value if the topology page was reachable by untrusted principals
Rotate the Thrift, Netty, and ZooKeeper TLS keystore and truststore passwords

Patch Information

Apache Storm 3.1.0 introduces redaction of credential-bearing configuration values before they are returned by any Nimbus API, including getTopologyPageInfo. Operators should validate the upgrade by requesting /api/v1/topology/{id} as a read-only principal and confirming that sensitive keys are masked in the configuration field.

Workarounds

Restrict topology.readonly.users and topology.readonly.groups to principals already trusted with cluster credentials until the upgrade is applied
Terminate access to the Storm UI and Nimbus API from untrusted networks using network access controls
Rotate any credentials previously reachable through topology_conf and audit ZooKeeper and TLS endpoints for anomalous reuse

bash

# Configuration example: remove untrusted principals from read-only topology ACLs
# in storm.yaml before upgrading, then rotate credentials in storm-cluster-auth.yaml
topology.readonly.users: []
topology.readonly.groups: []
topology.users: ["trusted-operator"]
topology.groups: ["storm-admins"]