CVE-2026-82431— Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Quick assessment
Affected
Apache Software Foundation Apache Storm Client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Storm Client是美国Apache基金会开源的一款服务端软件产品。 Apache Storm Client 3.0.0版本至3.1.0之前版本存在授权问题漏洞，该漏洞源于SimpleACLAuthorizer在nimbus.users为空时提前返回，未评估nimbus.groups，导致仅配置组访问限制时访问控制未生效，可能使已认证用户执行所有用户级操作，包括submitTopology、beginFileUpload和getNimbusConf。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Storm Client | 3.0.0< 3.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82431
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Source: CVE Program / CVE List V5
Vulnerability Description
Description
`SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty,
before `nimbus.groups` was considered. An operator who restricted cluster access by group alone, leaving
`nimbus.users` unset, therefore received no restriction at all: every authenticated principal was permitted
every user-level operation, including `submitTopology`, `beginFileUpload` and `getNimbusConf`.
`docs/SECURITY.md` presents `nimbus.groups` as a supported way to lock down a cluster, so a deployment
following the documentation could believe it was restricted while it was not. The failure is silent; nothing
in the logs or the configuration indicates that the group list is being ignored.
Both lists left empty continues to mean that no restriction is configured, which is the shipped default and
is unchanged.
Mitigation
Upgrade to 3.1.0, where `nimbus.groups` is evaluated whether or not `nimbus.users` is set.
Users who cannot upgrade immediately should additionally populate `nimbus.users` with the intended
principals, since a non-empty user list causes the group list to be evaluated on affected versions.
Operators should review Nimbus access logs for operations by principals outside the intended groups.
Note that after upgrading, a cluster configured with `nimbus.groups` alone becomes restrictive for the first
time. This includes `NimbusClient`, which calls `getLeader` on every connection, so clients outside the
configured groups will begin to be refused.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Storm Client 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Storm Client是美国Apache基金会开源的一款服务端软件产品。 Apache Storm Client 3.0.0版本至3.1.0之前版本存在授权问题漏洞，该漏洞源于SimpleACLAuthorizer在nimbus.users为空时提前返回，未评估nimbus.groups，导致仅配置组访问限制时访问控制未生效，可能使已认证用户执行所有用户级操作，包括submitTopology、beginFileUpload和getNimbusConf。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Storm Client | 3.0.0 ~ 3.1.0 | - |
|
II. Public POCs for CVE-2026-82431
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82431
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-82431 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-14 · 39 CVEs total
| CVE-2026-82434 | 10.0 CRITICAL | Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential |
| CVE-2026-78330 | Apache Syncope: Privilege escalation for admin user via JWT authentication | |
| CVE-2026-73579 | Apache Syncope: Non-recursive Any search could skip Realms restrictions | |
| CVE-2026-75015 | Apache Syncope: Nested secrets leak cleartext into audit records readable | |
| CVE-2026-75030 | Apache Syncope: Incomplete authorization checks for Group members deprovisioning | |
| CVE-2026-77051 | Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search | |
| CVE-2026-73668 | Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values | |
| CVE-2026-77147 | Apache Syncope: Groovy Sandbox escape for empty CommandArgs | |
| CVE-2026-77181 | Apache Syncope: ClientApp update entitlement not effective | |
| CVE-2026-77883 | Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBui | |
| CVE-2026-78318 | Apache Syncope: Unauthenticated reflected XSS in Console and Enduser | |
| CVE-2026-73470 | Apache Syncope: Delegating users can grant unowned Roles | |
| CVE-2026-78336 | Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user | |
| CVE-2026-82232 | Apache Syncope: SQL injection via sort parameter in Task search | |
| CVE-2026-86460 | Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence | |
| CVE-2026-87779 | Apache Syncope: AES Secret Key disclosure via log output | |
| CVE-2026-87785 | Apache Syncope: JWT subject spoofing | |
| CVE-2026-87802 | Apache Syncope: SRA OAuth2 JWT signature verification bypass | |
| CVE-2026-68570 | Apache Doris: Authorization bypass leading to unauthorized data access | |
| CVE-2026-72524 | Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Storm Client
-
CVE-2026-82436
Apache Storm Client: Deserialization of Untrusted Data from -
CVE-2026-82428
Apache Storm Client: Cross-Tenant Dependency Jar Substitutio -
CVE-2026-41081
Apache Storm Client: Anonymous principal assigned on TLS cli -
CVE-2026-35337
Apache Storm Client: RCE through Unsafe Deserialization via
Same vendor: Apache Software Foundation
-
CVE-2026-120367
Apache Axis2/Java: unbounded JSON request body buffering -
CVE-2026-123779
Apache Axis2/Java: exposeServiceMetadata not enforced on all -
CVE-2026-123753
Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultT -
CVE-2026-123766
Apache Axis2/Java: Cross-site scripting in the OpenAPI modul -
CVE-2026-123770
Apache Axis2/Java: Unbounded multipart and form-encoded requ
Same weakness: CWE-863
-
CVE-2026-118196
Apache Allura: OAuth1 rebinding -
CVE-2026-92683
Incomplete evaluation of multi-condition JWT where filter in -
CVE-2026-111453
Apache Airflow: API: asset queuedEvents DELETE checks Dag ed -
CVE-2026-111455
Apache Airflow: Connections API: async connection test autho -
CVE-2026-18093
IBM App Connect Enterprise is vulnerable to a credential exp