As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Apache Storm Client versions before 3.1.0 contain an authorization bypass vulnerability where SimpleACLAuthorizer returns early if nimbus.users is empty, bypassing nimbus.groups restrictions. Operators who configured group-level access control without setting nimbus.users would grant unrestricted access to all authenticated principals. The vulnerability was introduced in version 3.0.0 and is rated important severity.
Why it matters: Organizations running Apache Storm Client 3.0.0 through 3.0.x should upgrade to 3.1.0 immediately, as unpatched clusters configured with group restrictions alone have no actual access controls in place.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
CVE-2026-82431 affects Apache Storm Client versions 3.0.0 before 3.1.0 and rates 9.8 CVSS. The SimpleACLAuthorizer component returns early when nimbus.users is empty, failing to evaluate nimbus.groups restrictions. Operators who configured group-based access control without setting nimbus.users left their clusters unprotected from any authenticated user.
Why it matters: Storm operators using group-level access controls without nimbus.users should upgrade to 3.1.0 immediately, as their authorization is currently not enforced.
- Source published
- First seen by Cybersecurity Tracker