Executive Summary
A critical vulnerability, CVE-2026-82431, with a CVSS score of 9.8, was discovered in the Apache Storm Client, affecting versions 3.0.0 and earlier. This vulnerability allows an attacker to bypass access controls, permitting every authenticated principal to perform user-level operations, including `submitTopology`, `beginFileUpload`, and `getNimbusConf`. The vulnerability is exploitable due to the improper evaluation of the `nimbus.groups` list when `nimbus.users` is empty.
Technical Analysis
The vulnerability is classified as an access control issue (CWE-863). The `SimpleACLAuthorizer` incorrectly evaluates the user-level command set by returning early when `nimbus.users` is empty, before considering `nimbus.groups`. This causes an operator who restricts cluster access by group alone, leaving `nimbus.users` unset, to receive no restriction at all. The failure is silent, with no indication in the logs or configuration that the group list is being ignored.
How It Gets Exploited
An attacker with an authenticated principal can exploit this vulnerability by performing user-level operations without being part of the intended groups. For example, an attacker can send a request to the `submitTopology` endpoint without being authorized, as the `nimbus.groups` list is not evaluated when `nimbus.users` is empty. This allows the attacker to bypass access controls and perform sensitive operations.
Impact Assessment
The Apache Storm Client versions 3.0.0 and earlier are affected. An attacker can achieve arbitrary user-level operations, including `submitTopology`, `beginFileUpload`, and `getNimbusConf`. The CVSS score of 9.8 indicates a critical severity level, with high impacts on confidentiality, integrity, and availability.
Recommended Actions
To mitigate this vulnerability, upgrade to Apache Storm Client version 3.1.0 or later. If an immediate upgrade is not possible, populate `nimbus.users` with the intended principals, as a non-empty user list causes the group list to be evaluated on affected versions. Additionally, review Nimbus access logs for operations by principals outside the intended groups.
Sources
- National Vulnerability Database (NVD)
- Apache Software Foundation