CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
Apache Storm Nimbus/UI 3.0.0 leaks unredacted merged daemon configuration through the topology page, exposing secrets to UI users.
CVE-2026-84179 (severity: important) affects Apache Storm Nimbus (storm-server) and Storm UI (storm-webapp) versions 3.0.0 before 3.1.0. The getTopologyPageInfo function merged the Nimbus daemon configuration with topology configuration and returned it unredacted in the topology_conf field of TopologyPageInfo, which the Storm UI copied verbatim. This can expose sensitive daemon configuration values to topology users.
- CVE-2026-84179 rated important by Apache
- Affects Storm Nimbus and Storm UI 3.0.0 before 3.1.0
- Unredacted merged daemon configuration exposed via topology_conf
- Fix available in Apache Storm 3.1.0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84179 | Secret Disclosure via Topology Page API in Apache Storm before 3.1.0 | 6.5 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: important Affected versions: - Apache Storm Nimbus (org. apache. storm:storm-server) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.