CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
Apache Storm Nimbus and UI return unredacted daemon configuration, including ZooKeeper and keystore secrets, to authorized users.
CVE-2026-82433 (rated moderate) affects Apache Storm Nimbus (storm-server) and Storm UI (storm-webapp) versions 3.0.0 before 3.1.0. The getNimbusConf operation returned the complete daemon configuration without redaction after only a user-level authorization check. Where configured, the response includes storm.zookeeper.auth.payload plus keystore and related secrets.
- getNimbusConf returned full daemon config without redaction
- Only user-level authorization check applied
- Leaks storm.zookeeper.auth.payload and keystore secrets when configured
- Affects storm-server and storm-webapp 3.0.0 before 3.1.0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82433 | Unredacted Configuration & Credential Disclosure in Apache Storm Nimbus and UI | 6.5 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: moderate Affected versions: - Apache Storm Nimbus (org. apache. storm:storm-server) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.