Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82431— Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

Quick assessment

Affected
Apache Software Foundation Apache Storm Client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

描述 在评估用户级命令集时，当 为空时会提前返回，此时尚未考虑 。因此，那些仅通过组（ ）来限制集群访问、且未设置 的运维人员，实际上并未施加任何限制：所有经过身份验证的主体都可以执行所有用户级操作，包括 、 和 。 将 描述为锁定集群的一种受支持方式，因此按照文档进行部署的用户可能会误以为集群已被限制，但实际上并未受限。该缺陷是静默的；日志或配置中没有任何指示表明组列表被忽略。 如果两个列表（ 和 ）均为空，仍然表示未配置任何限制，这是出厂默认行为，且保持不变。 缓解措施 升级至 3.1.0 版本，在该版本中，无

AI Predicted 6.5 Difficulty: Moderate
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82431

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Source: CVE Program / CVE List V5
Vulnerability Description
Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered. An operator who restricted cluster access by group alone, leaving `nimbus.users` unset, therefore received no restriction at all: every authenticated principal was permitted every user-level operation, including `submitTopology`, `beginFileUpload` and `getNimbusConf`. `docs/SECURITY.md` presents `nimbus.groups` as a supported way to lock down a cluster, so a deployment following the documentation could believe it was restricted while it was not. The failure is silent; nothing in the logs or the configuration indicates that the group list is being ignored. Both lists left empty continues to mean that no restriction is configured, which is the shipped default and is unchanged. Mitigation Upgrade to 3.1.0, where `nimbus.groups` is evaluated whether or not `nimbus.users` is set. Users who cannot upgrade immediately should additionally populate `nimbus.users` with the intended principals, since a non-empty user list causes the group list to be evaluated on affected versions. Operators should review Nimbus access logs for operations by principals outside the intended groups. Note that after upgrading, a cluster configured with `nimbus.groups` alone becomes restrictive for the first time. This includes `NimbusClient`, which calls `getLeader` on every connection, so clients outside the configured groups will begin to be refused. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Storm Client 3.0.0 ~ 3.1.0 -

II. Public POCs for CVE-2026-82431

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82431

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-82431 (1)

Same Patch Batch · Apache Software Foundation · 2026-09-14 · 39 CVEs total

CVE-2026-82434 10.0 CRITICAL Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential
CVE-2026-78330 Apache Syncope: Privilege escalation for admin user via JWT authentication
CVE-2026-73579 Apache Syncope: Non-recursive Any search could skip Realms restrictions
CVE-2026-75015 Apache Syncope: Nested secrets leak cleartext into audit records readable
CVE-2026-75030 Apache Syncope: Incomplete authorization checks for Group members deprovisioning
CVE-2026-77051 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
CVE-2026-73668 Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs
CVE-2026-77181 Apache Syncope: ClientApp update entitlement not effective
CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBui
CVE-2026-78318 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
CVE-2026-73470 Apache Syncope: Delegating users can grant unowned Roles
CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search
CVE-2026-86460 Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
CVE-2026-87779 Apache Syncope: AES Secret Key disclosure via log output
CVE-2026-87785 Apache Syncope: JWT subject spoofing
CVE-2026-87802 Apache Syncope: SRA OAuth2 JWT signature verification bypass
CVE-2026-68570 Apache Doris: Authorization bypass leading to unauthorized data access
CVE-2026-72524 Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache Storm Client
Same vendor: Apache Software Foundation
Same weakness: CWE-863

V. Comments for CVE-2026-82431

No comments yet

Leave a comment