CVE-2026-84179— Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
Quick assessment
Affected
Apache Software Foundation Apache Storm Nimbus
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Storm Nimbus是美国Apache基金会开源的一个负责分布式实时计算集群任务调度与状态监控的主控服务。 Apache Storm Nimbus 3.0.0版本至3.1.0之前版本和Apache Storm UI 3.0.0版本至3.1.0之前版本存在安全漏洞，该漏洞源于getTopologyPageInfo将Nimbus守护进程配置与拓扑自身配置合并后，在TopologyPageInfo的topology_conf字段中返回未脱敏结果，Storm UI又将该值原样复制到GET /ap
Possible ATT&CK Techniques 2 AI
T1557 · Adversary-in-the-Middle T1213 · Data from Information RepositoriesAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Storm Nimbus | 3.0.0< 3.1.0 |
affected |
| Apache Software Foundation | Apache Storm UI | 3.0.0< 3.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84179
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
Source: CVE Program / CVE List V5
Vulnerability Description
Description
getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/{id} and of the corresponding metrics endpoint.
Where the cluster is configured with them, the merged map includes storm.zookeeper.auth.payload, which Storm's own documentation directs operators to keep in storm-cluster-auth.yaml under permissions that deny access from workers, together with the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration, and any plugin key whose name denotes a secret.
getTopologyPageInfo is a topology read-only operation. Under SimpleACLAuthorizer a principal listed in topology.readonly.users or topology.readonly.groups could therefore read daemon credentials that the dedicated cluster configuration API, getNimbusConf, redacts and that is gated on nimbus.users instead. The sibling operations that exist to serve configuration were masked; the topology page, which merges in strictly more daemon state, was not.
Mitigation
Upgrade to 3.1.0, where credential-bearing values are masked before any configuration is served over the Nimbus API.
Users who cannot upgrade immediately should remove any principal that is not trusted with cluster credentials from topology.readonly.users, topology.readonly.groups, topology.users and topology.groups, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through the topology page.
Credit
Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Storm Nimbus 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Storm Nimbus是美国Apache基金会开源的一个负责分布式实时计算集群任务调度与状态监控的主控服务。 Apache Storm Nimbus 3.0.0版本至3.1.0之前版本和Apache Storm UI 3.0.0版本至3.1.0之前版本存在安全漏洞，该漏洞源于getTopologyPageInfo将Nimbus守护进程配置与拓扑自身配置合并后，在TopologyPageInfo的topology_conf字段中返回未脱敏结果，Storm UI又将该值原样复制到GET /ap
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Storm Nimbus | 3.0.0 ~ 3.1.0 | - |
|
| Apache Software Foundation | Apache Storm UI | 3.0.0 ~ 3.1.0 | - |
|
II. Public POCs for CVE-2026-84179
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84179
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-84179 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-14 · 39 CVEs total
| CVE-2026-82434 | 10.0 CRITICAL | Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential |
| CVE-2026-78330 | Apache Syncope: Privilege escalation for admin user via JWT authentication | |
| CVE-2026-73579 | Apache Syncope: Non-recursive Any search could skip Realms restrictions | |
| CVE-2026-75015 | Apache Syncope: Nested secrets leak cleartext into audit records readable | |
| CVE-2026-75030 | Apache Syncope: Incomplete authorization checks for Group members deprovisioning | |
| CVE-2026-77051 | Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search | |
| CVE-2026-73668 | Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values | |
| CVE-2026-77147 | Apache Syncope: Groovy Sandbox escape for empty CommandArgs | |
| CVE-2026-77181 | Apache Syncope: ClientApp update entitlement not effective | |
| CVE-2026-77883 | Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBui | |
| CVE-2026-78318 | Apache Syncope: Unauthenticated reflected XSS in Console and Enduser | |
| CVE-2026-73470 | Apache Syncope: Delegating users can grant unowned Roles | |
| CVE-2026-78336 | Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user | |
| CVE-2026-82232 | Apache Syncope: SQL injection via sort parameter in Task search | |
| CVE-2026-86460 | Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence | |
| CVE-2026-87779 | Apache Syncope: AES Secret Key disclosure via log output | |
| CVE-2026-87785 | Apache Syncope: JWT subject spoofing | |
| CVE-2026-87802 | Apache Syncope: SRA OAuth2 JWT signature verification bypass | |
| CVE-2026-68570 | Apache Doris: Authorization bypass leading to unauthorized data access | |
| CVE-2026-72524 | Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Storm Nimbus
-
CVE-2026-82427
Apache Storm Nimbus: Path Traversal as the Supervisor User v -
CVE-2026-82433
Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredact -
CVE-2026-82432
Apache Storm Nimbus: Blobstore Authorization Bypass via Reba -
CVE-2026-82434
Apache Storm Nimbus, Apache Storm Client: Disclosure of the -
CVE-2026-82426
Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unval
Same vendor: Apache Software Foundation
-
CVE-2026-71569
Apache Camel: Camel-A2A Push Notification Webhook Guard Acce -
CVE-2026-115942
Apache Qpid Proton C: Verifying non compliant TLS wildcard c -
CVE-2026-114230
Apache Qpid Proton C: Potential authentication bypass: regul -
CVE-2026-105042
Apache Qpid Proton C: Unbounded recursion in parsing AMQP me -
CVE-2026-105031
Apache Qpid Proton C: The OpenSSL TLS implementation adds a
Same weakness: CWE-522
-
CVE-2026-118763
@sigstore/oci sends the registry Authorization header to a c -
CVE-2026-104314
Langflow OSS is affected by multiple vulnerabilities -
CVE-2026-110192
Langflow OSS is affected by multiple vulnerabilities -
CVE-2026-87097
Acronis Cyber Protect 17 凭据保护不足导致敏感信息泄露 -
CVE-2026-104384
Insufficiently protected credentials in EagleCloud Aquila on