CVE-2026-124496: Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer

Published Nov 11, 2026

Updated

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

Affected Software

1 affected component

Apache storm

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Storm to a version that resolves this vulnerability.
Fixed in 3.2.0

Event History

Nov 11, 2026

CVE Published

via MITRE·12:35 PM

Data Sourced

via MITRE·12:35 PM

DescriptionWeakness

Data Sourced

via NVD·01:17 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Apache Storm deployments that expose the DRPC HTTP endpoint and allow authenticated clients are affected if they rely on the impersonation authorizer to control which users may be impersonated.

What does an attacker need to exploit it?

An attacker needs to authenticate to the DRPC HTTP endpoint. They can then use doAsUser to act as another user and execute DRPC functions restricted to that user without the configured impersonation authorization check.

Is upgrading the available remediation?

Yes. Apache Storm version 3.2.0 fixes the issue.

CVE-2026-124496: Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is upgrading the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is upgrading the available remediation?