CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Apache Storm Client 3.0.0 ACL bypass lets every authenticated principal bypass restrictions when nimbus.groups is set without nimbus.users.
CVE-2026-82431 affects Apache Storm Client (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. SimpleACLAuthorizer returned early when nimbus.users was empty, before evaluating nimbus.groups. Operators restricting cluster access by group alone received no restriction, so any authenticated principal could execute user-level commands. Fixed in version 3.1.0.
- Affects Apache Storm Client 3.0.0 before 3.1.0
- SimpleACLAuthorizer skips group checks when nimbus.users is empty
- Group-only ACL configurations provide no restriction at all
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82431 | Authorization Bypass in Apache Storm When nimbus.groups Is Set Without nimbus.users | 9.8 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: important Affected versions: - Apache Storm Client (org. apache. storm:storm-client) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.