Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82433— Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

Quick assessment

Affected
Apache Software Foundation Apache Storm Nimbus
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

漏洞描述 在仅执行用户级授权检查后， 方法返回了未脱敏的完整守护进程配置信息。如果集群中配置了相关参数，该响应将包含 以及 Thrift、Netty 和 ZooKeeper TLS 配置的 keystore 和 truststore 密码。鉴于该项目在展示其他位置时对密码进行了掩码处理，此处的遗漏属于一致性缺失，而非有意为之。 UI 端点 进一步加剧了这一问题。该端点未添加 注解，而授权过滤器将缺失的注解视为“无需设置访问控制”，直接返回，因此该端点根本未执行任何基于用户的检查，并以 UI 守护进程自身的身份代理了

AI Predicted 6.0 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82433

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
Source: CVE Program / CVE List V5
Vulnerability Description
Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes `storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration. The project masks passwords elsewhere before display, so the omission here is inconsistent rather than intended. The UI endpoint `/api/v1/cluster/configuration` compounded this. It carried no `@AuthNimbusOp` annotation, and the authorization filter treated a missing annotation as "no gate required" and returned immediately, so the endpoint applied no per-user check at all and proxied the request under the UI daemon's own principal. Any user able to pass `ui.filter` therefore received the full configuration, including principals that Nimbus itself would have refused.  Mitigation Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and where every UI API endpoint must declare its authorization explicitly. Users who cannot upgrade immediately should place the UI behind an authenticating reverse proxy that restricts `/api/v1/cluster/configuration`, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through it. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Storm Nimbus 3.0.0 ~ 3.1.0 -
Apache Software Foundation Apache Storm UI 3.0.0 ~ 3.1.0 -

II. Public POCs for CVE-2026-82433

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82433

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-82433 (1)

Same Patch Batch · Apache Software Foundation · 2026-09-14 · 39 CVEs total

CVE-2026-82434 10.0 CRITICAL Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential
CVE-2026-78330 Apache Syncope: Privilege escalation for admin user via JWT authentication
CVE-2026-73579 Apache Syncope: Non-recursive Any search could skip Realms restrictions
CVE-2026-75015 Apache Syncope: Nested secrets leak cleartext into audit records readable
CVE-2026-75030 Apache Syncope: Incomplete authorization checks for Group members deprovisioning
CVE-2026-77051 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
CVE-2026-73668 Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs
CVE-2026-77181 Apache Syncope: ClientApp update entitlement not effective
CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBui
CVE-2026-78318 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
CVE-2026-73470 Apache Syncope: Delegating users can grant unowned Roles
CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search
CVE-2026-86460 Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
CVE-2026-87779 Apache Syncope: AES Secret Key disclosure via log output
CVE-2026-87785 Apache Syncope: JWT subject spoofing
CVE-2026-87802 Apache Syncope: SRA OAuth2 JWT signature verification bypass
CVE-2026-68570 Apache Doris: Authorization bypass leading to unauthorized data access
CVE-2026-72524 Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache Storm Nimbus
Same vendor: Apache Software Foundation
Same weakness: CWE-522

V. Comments for CVE-2026-82433

No comments yet

Leave a comment