CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

Apache Storm's getTopologyPageInfo operation merges the Nimbus daemon configuration into a topology's own configuration and returns it unredacted in the topology_conf field, which the Storm UI copies verbatim into GET /api/v1/topology/{id} and the corresponding metrics endpoint. On clusters using SimpleACLAuthorizer, any principal listed in topology.readonly.users or topology.readonly.groups can read this merged map, which includes storm.zookeeper.auth.payload plus the Thrift, Netty and ZooKeeper TLS keystore and truststore passwords and any plugin key whose name denotes a secret. This bypasses the dedicated getNimbusConf API, which redacts credentials and is gated on the more privileged nimbus.users setting. All Apache Storm versions prior to 3.1.0 running Nimbus and the Storm UI with ACL authorization are affected; no public proof of concept or exploitation in the wild is known.

Do: Upgrade to Apache Storm 3.1.0, where credential-bearing values are masked before any configuration is served over the Nimbus API. If you cannot upgrade immediately, remove any principal not trusted with cluster credentials from topology.readonly.users, topology.readonly.groups, topology.users and topology.groups, and audit access logs for GET /api/v1/topology/{id} and the metrics endpoint. Rotate the ZooKeeper authentication payload and any Thrift, Netty or ZooKeeper TLS keystore/truststore passwords that were reachable through the topology page.