CVE-2026-82431

Apache Storm's SimpleACLAuthorizer returned early when nimbus.users was empty, so nimbus.groups was never evaluated and a cluster that restricted access by group alone effectively had no user-level restrictions at all. Any authenticated principal, including those outside the intended groups, could perform every user-level operation against Nimbus, such as submitTopology, beginFileUpload, and getNimbusConf — and since submitted topologies run attacker-supplied code on worker nodes, the impact is unauthorized code execution on the cluster plus disclosure of its configuration. The failure is silent: nothing in the logs or configuration indicates the group list is being ignored, even though the project's own SECURITY.md documents nimbus.groups as a supported way to lock down a cluster. Deployments on versions before 3.1.0 that use SimpleACLAuthorizer with nimbus.groups configured but nimbus.users unset are affected; no public proof of concept or known in-the-wild exploitation exists.

What to do: Upgrade to Apache Storm 3.1.0, where nimbus.groups is evaluated whether or not nimbus.users is set. If you cannot upgrade immediately, populate nimbus.users with the intended principals — a non-empty user list causes the group list to be evaluated on affected versions — and review Nimbus access logs for user-level operations performed by principals outside the intended groups. Note that after upgrading, a groups-only configuration becomes restrictive for the first time: NimbusClient calls getLeader on every connection, so clients outside the configured groups will begin to be refused, so plan access-list changes before the upgrade.