Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the storm.zookeeper.topology.auth.payload configuration parameter. An attacker can gain unauthorized access to sensitive ZooKeeper credentials by obtaining read-only topology permissions or...

Insufficiently Protected Credentials

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the storm.zookeeper.topology.auth.payload configuration parameter. An attacker can gain unauthorized access to sensitiv...

CVE-2026-82434: Insufficiently Protected Credentials

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...