CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

Apache Storm before 3.1.0 leaks its full daemon configuration, including the ZooKeeper authentication payload (storm.zookeeper.auth.payload) and the TLS keystore/truststore passwords for Thrift, Netty, and ZooKeeper, through two paths: the Nimbus getNimbusConf call, which returns credentials unredacted after only a user-level authorization check, and the UI REST endpoint /api/v1/cluster/configuration, which applied no per-user check at all because it lacked an @AuthNimbusOp annotation and the filter treated a missing annotation as requiring no gate, proxying the request under the UI daemon's own principal. Any user who can pass the UI's ui.filter authentication can trigger the UI path and retrieve secrets that Nimbus itself would have refused to share. An attacker gains Kerberos/TLS credentials and ZooKeeper auth material that could allow impersonating cluster components and further compromise of the Storm cluster and its ZooKeeper ensemble. All Apache Storm deployments prior to 3.1.0 are affected where those credentials are configured. No public proof of concept exists and no exploitation in the wild is known.

Do: Upgrade to Apache Storm 3.1.0, which masks credential-bearing configuration values and requires explicit authorization declarations on every UI API endpoint. If you cannot upgrade immediately, place the Storm UI behind an authenticating reverse proxy that restricts /api/v1/cluster/configuration, and review UI access logs for requests to that endpoint. Rotate the ZooKeeper authentication payload and any Thrift, Netty, or ZooKeeper TLS keystore/truststore passwords that were reachable through the exposed endpoints.