Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper evaluation of the SimpleACLAuthorizer process when nimbus.groups is configured without nimbus.users. An attacker can gain unauthorized access to user-level operations by authenticating as any...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getTopologyPageInfo process. An attacker can access sensitive daemon configuration data, including authentication payloads and passwords, by sending requests to the topology page endpoints...

Insufficiently Protected Credentials

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getTopologyPageInfo process. An attacker can access sensitive daemon configuration data, including authentication...

CVE-2026-82431

Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...

CVE-2026-82431

The Apache Storm cluster is vulnerable to an authorization bypass in the SimpleACLAuthorizer component. The vulnerability occurs because the authorizer returns early when the nimbus.users list is empty, failing to evaluate the nimbus.groups list. Consequently, operators who configure access restr...

CVE-2026-82431 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...

CVE-2026-82431 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...

EUVD-2026-77525

Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...

CVE-2026-82431: Incorrect Authorization

Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...

PT-2026-91228

Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...

CVE-2026-84179: Insufficiently Protected Credentials

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...