CVE-2026-41081

Apache Storm versions up to 2.8.7 are vulnerable to an improper handling of TLS client authentication failures . When TLS transport is enabled without requiring client certificates (the default), the TlsTransportPlugin suppresses the SSLPeerUnverifiedException and assigns a fallback principal (CN...