CVE-2026-82431— Apache Storm Client 认证绕过漏洞
一分钟漏洞结论
影响对象
Apache Software Foundation Apache Storm Client
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
描述 在评估用户级命令集时，当 为空时会提前返回，此时尚未考虑 。因此，那些仅通过组（ ）来限制集群访问、且未设置 的运维人员，实际上并未施加任何限制：所有经过身份验证的主体都可以执行所有用户级操作，包括 、 和 。 将 描述为锁定集群的一种受支持方式，因此按照文档进行部署的用户可能会误以为集群已被限制，但实际上并未受限。该缺陷是静默的；日志或配置中没有任何指示表明组列表被忽略。 如果两个列表（ 和 ）均为空，仍然表示未配置任何限制，这是出厂默认行为，且保持不变。 缓解措施 升级至 3.1.0 版本，在该版本中，无
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-82431 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
来源: CVE Program / CVE List V5
Vulnerability Description
Description
`SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty,
before `nimbus.groups` was considered. An operator who restricted cluster access by group alone, leaving
`nimbus.users` unset, therefore received no restriction at all: every authenticated principal was permitted
every user-level operation, including `submitTopology`, `beginFileUpload` and `getNimbusConf`.
`docs/SECURITY.md` presents `nimbus.groups` as a supported way to lock down a cluster, so a deployment
following the documentation could believe it was restricted while it was not. The failure is silent; nothing
in the logs or the configuration indicates that the group list is being ignored.
Both lists left empty continues to mean that no restriction is configured, which is the shipped default and
is unchanged.
Mitigation
Upgrade to 3.1.0, where `nimbus.groups` is evaluated whether or not `nimbus.users` is set.
Users who cannot upgrade immediately should additionally populate `nimbus.users` with the intended
principals, since a non-empty user list causes the group list to be evaluated on affected versions.
Operators should review Nimbus access logs for operations by principals outside the intended groups.
Note that after upgrading, a cluster configured with `nimbus.groups` alone becomes restrictive for the first
time. This includes `NimbusClient`, which calls `getLeader` on every connection, so clients outside the
configured groups will begin to be refused.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Storm Client | 3.0.0 ~ 3.1.0 | - |
|
二、漏洞 CVE-2026-82431 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-82431 的情报信息
请登录查看更多情报信息。
CVE-2026-82431 其他参考 (1)
同批安全公告 · Apache Software Foundation · 2026-09-14 · 共 39 条
| CVE-2026-82434 | 10.0 CRITICAL | Apache Storm 向只读用户及日志泄露ZK凭证 |
| CVE-2026-78330 | Apache Syncope 管理员JWT权限提升漏洞 | |
| CVE-2026-73579 | Apache Syncope 非递归Any搜索绕过Realm限制 | |
| CVE-2026-75015 | Apache Syncope 嵌套密钥泄露明文的审计记录 | |
| CVE-2026-75030 | Apache Syncope 组成员权限检查不完整漏洞 | |
| CVE-2026-77051 | Apache Syncope SQL注入漏洞 | |
| CVE-2026-73668 | Apache Syncope 机密ConnId配置跨域泄露 | |
| CVE-2026-77147 | Apache Syncope Groovy沙箱逃逸漏洞 | |
| CVE-2026-77181 | Apache Syncope 客户端应用更新权限失效 | |
| CVE-2026-77883 | Apache Syncope JEXL导航致信息泄露 | |
| CVE-2026-78318 | Apache Syncope 控制台反射型XSS漏洞 | |
| CVE-2026-73470 | Apache Syncope 非所有者角色授权越权漏洞 | |
| CVE-2026-78336 | Apache Syncope OIDC提供者列表信息泄露漏洞 | |
| CVE-2026-82232 | Apache Syncope 任务搜索SQL注入 | |
| CVE-2026-86460 | Apache Syncope FIQL查询Cypher注入漏洞 | |
| CVE-2026-87779 | Apache Syncope AES密钥泄露 | |
| CVE-2026-87785 | Apache Syncope JWT主体欺骗漏洞 | |
| CVE-2026-87802 | Apache Syncope 远程代码执行漏洞 | |
| CVE-2026-68570 | Apache Doris 授权绕过导致未授权数据访问漏洞 | |
| CVE-2026-72524 | Apache Doris 授权绕过导致任意表读写删 |
显示前 20 条，共 39 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-82431
暂无评论