Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getNimbusConf process. An attacker can obtain sensitive configuration data, including authentication payloads and keystore or truststore passwords, by making unauthorized requests to the...

Insufficiently Protected Credentials

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getNimbusConf process. An attacker can obtain sensitive configuration data, including authentication payloads and...

CVE-2026-82433

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

CVE-2026-82433: Insufficiently Protected Credentials

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...