CVE-2026-124496

The Apache Storm DRPC HTTP endpoint contains a vulnerability where an authenticated client can act as another user by bypassing the configured impersonation authorizer . This allows an authenticated user to execute DRPC functions restricted to different users. To remediate this issue, users are r...

CVE-2026-124496 Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue...