CVE-2026-82431

Apache Storm 's SimpleACLAuthorizer contained a logic flaw: when nimbus.users was empty, the code returned early before evaluating nimbus.groups, silently ignoring group-based access controls. Operators who restricted cluster access by group alone received no restriction at all —every authenticat...