CVE-2026-82433— Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
Quick assessment
Affected
Apache Software Foundation Apache Storm Nimbus
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Storm Nimbus是美国Apache基金会开源的一个负责分布式实时计算集群任务调度与状态监控的主控服务。 Apache Storm Nimbus 3.0.0版本和Apache Storm UI 3.0.0版本存在安全漏洞，该漏洞源于getNimbusConf在仅进行用户级授权检查后返回完整的守护进程配置，且UI端点/api/v1/cluster/configuration缺少授权注解而被授权过滤器视为无需校验，导致未经充分授权的用户可获取包含敏感凭据的完整配置信息。
Possible ATT&CK Techniques 1 AI
T1210 · Exploitation of Remote ServicesAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Storm Nimbus | 3.0.0< 3.1.0 |
affected |
| Apache Software Foundation | Apache Storm UI | 3.0.0< 3.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82433
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
Source: CVE Program / CVE List V5
Vulnerability Description
Description
`getNimbusConf` returned the complete daemon configuration without redaction after only a user-level
authorization check. Where the cluster is configured with them, that response includes
`storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and
ZooKeeper TLS configuration. The project masks passwords elsewhere before display, so the omission here is
inconsistent rather than intended.
The UI endpoint `/api/v1/cluster/configuration` compounded this. It carried no `@AuthNimbusOp` annotation,
and the authorization filter treated a missing annotation as "no gate required" and returned immediately, so
the endpoint applied no per-user check at all and proxied the request under the UI daemon's own principal.
Any user able to pass `ui.filter` therefore received the full configuration, including principals that
Nimbus itself would have refused.
Mitigation
Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and where
every UI API endpoint must declare its authorization explicitly.
Users who cannot upgrade immediately should place the UI behind an authenticating reverse proxy that
restricts `/api/v1/cluster/configuration`, and should rotate the ZooKeeper authentication payload and any
TLS keystore or truststore passwords that were reachable through it.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Storm Nimbus 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Storm Nimbus是美国Apache基金会开源的一个负责分布式实时计算集群任务调度与状态监控的主控服务。 Apache Storm Nimbus 3.0.0版本和Apache Storm UI 3.0.0版本存在安全漏洞，该漏洞源于getNimbusConf在仅进行用户级授权检查后返回完整的守护进程配置，且UI端点/api/v1/cluster/configuration缺少授权注解而被授权过滤器视为无需校验，导致未经充分授权的用户可获取包含敏感凭据的完整配置信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Storm Nimbus | 3.0.0 ~ 3.1.0 | - |
|
| Apache Software Foundation | Apache Storm UI | 3.0.0 ~ 3.1.0 | - |
|
II. Public POCs for CVE-2026-82433
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82433
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-82433 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-14 · 39 CVEs total
| CVE-2026-82434 | 10.0 CRITICAL | Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential |
| CVE-2026-78330 | Apache Syncope: Privilege escalation for admin user via JWT authentication | |
| CVE-2026-73579 | Apache Syncope: Non-recursive Any search could skip Realms restrictions | |
| CVE-2026-75015 | Apache Syncope: Nested secrets leak cleartext into audit records readable | |
| CVE-2026-75030 | Apache Syncope: Incomplete authorization checks for Group members deprovisioning | |
| CVE-2026-77051 | Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search | |
| CVE-2026-73668 | Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values | |
| CVE-2026-77147 | Apache Syncope: Groovy Sandbox escape for empty CommandArgs | |
| CVE-2026-77181 | Apache Syncope: ClientApp update entitlement not effective | |
| CVE-2026-77883 | Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBui | |
| CVE-2026-78318 | Apache Syncope: Unauthenticated reflected XSS in Console and Enduser | |
| CVE-2026-73470 | Apache Syncope: Delegating users can grant unowned Roles | |
| CVE-2026-78336 | Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user | |
| CVE-2026-82232 | Apache Syncope: SQL injection via sort parameter in Task search | |
| CVE-2026-86460 | Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence | |
| CVE-2026-87779 | Apache Syncope: AES Secret Key disclosure via log output | |
| CVE-2026-87785 | Apache Syncope: JWT subject spoofing | |
| CVE-2026-87802 | Apache Syncope: SRA OAuth2 JWT signature verification bypass | |
| CVE-2026-68570 | Apache Doris: Authorization bypass leading to unauthorized data access | |
| CVE-2026-72524 | Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Storm Nimbus
-
CVE-2026-82427
Apache Storm Nimbus: Path Traversal as the Supervisor User v -
CVE-2026-82432
Apache Storm Nimbus: Blobstore Authorization Bypass via Reba -
CVE-2026-82434
Apache Storm Nimbus, Apache Storm Client: Disclosure of the -
CVE-2026-82426
Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unval -
CVE-2026-82441
Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster
Same vendor: Apache Software Foundation
-
CVE-2026-71569
Apache Camel: Camel-A2A Push Notification Webhook Guard Acce -
CVE-2026-115942
Apache Qpid Proton C: Verifying non compliant TLS wildcard c -
CVE-2026-114230
Apache Qpid Proton C: Potential authentication bypass: regul -
CVE-2026-105042
Apache Qpid Proton C: Unbounded recursion in parsing AMQP me -
CVE-2026-105031
Apache Qpid Proton C: The OpenSSL TLS implementation adds a
Same weakness: CWE-522
-
CVE-2026-118763
@sigstore/oci sends the registry Authorization header to a c -
CVE-2026-104314
Langflow OSS is affected by multiple vulnerabilities -
CVE-2026-110192
Langflow OSS is affected by multiple vulnerabilities -
CVE-2026-87097
Acronis Cyber Protect 17 凭据保护不足导致敏感信息泄露 -
CVE-2026-104384
Insufficiently protected credentials in EagleCloud Aquila on