CVE-2026-82433 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

CVE-2026-84179

Apache Storm (Nimbus component and Storm UI) is affected by an information disclosure vulnerability in getTopologyPageInfo, which merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field. The Storm UI copied ...