CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
Apache Storm Nimbus and Client expose ZooKeeper topology credentials to read-only users and logs, fixed in 3.1.0.
CVE-2026-82434 affects Apache Storm Nimbus (storm-server) and Storm Client (storm-client) versions 3.0.0 before 3.1.0. When ZooKeeper authentication is configured, Storm retains storm.zookeeper.topology.auth.payload in the topology configuration because workers need it, but Nimbus serves that configuration verbatim to callers holding only read-only access. The credential also leaks into logs.
- ZooKeeper topology auth payload exposed to read-only users
- Credential also written to logs
- Affects storm-server and storm-client 3.0.0 before 3.1.0
- Fix: upgrade to Apache Storm 3.1.0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82434 | Apache Storm Leaks ZooKeeper Topology Credential to Read-Only Users and Logs | 10.0 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: Affected versions: - Apache Storm Nimbus (org. apache. storm:storm-server) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.