Apache Storm DRPC doAsUser skips impersonation checks (CVE-2026-124496)
Original title: CVE-2026-124496: Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer
An authenticated Storm client can run DRPC functions limited to another user; 3.2.0 fixes storm-server.
Apache rated CVE-2026-124496 low. On storm-server 3.0.0 before 3.2.0, the DRPC HTTP endpoint lets an authenticated client use doAsUser without the configured impersonation authorizer. The client can then execute DRPC functions restricted to another user. Version 3.2.0 fixes the issue.
- The affected artifact is org.apache.storm:storm-server.
- Rui Abreu posted the notice on November 10.
- Javier García Herrera is credited as the finder.
- Apache's stated severity is low.
Impact: Execute DRPC functions restricted to another user
| Product | Affected | Fixed in |
|---|---|---|
| Apache Storm | 3.0.0 before 3.2.0 | 3.2.0 |
- 1.Upgrade Apache Storm storm-server to 3.2.0.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124496 | Impersonation authorizer bypass in Apache Storm DRPC HTTP | — | — |
From the original article
Posted by Rui Abreu on Nov 10 Severity: low Affected versions: - Apache Storm (org. apache. storm:storm-server) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.