CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
Description
When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose only grant was the ability to view a topology received its ZooKeeper credential.
That credential is not read-only. The cluster state implementation uses write-capable ACLs for worker heartbeats, backpressure and error state, so a recipient can forge or remove that state for the topology concerned. It is not a write credential on assignments.
The same advisory covers the submission client, which logged the generated payload at INFO on every submission that generated one, and the SASL handlers, which logged it at DEBUG. The credential therefore also reached any log aggregation or support bundle collected from the cluster.
Mitigation
Upgrade to 3.1.0, where the payload is removed from the configuration served to read-only callers and is no longer written to logs.
Users who cannot upgrade immediately should rotate storm.zookeeper.topology.auth.payload for existing topologies, review retained logs and support bundles for the value, and restrict read-only topology permissions to trusted principals.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Storm Nimbus, Apache Storm Clientto a version that resolves this vulnerability.Fixed in 3.1.0 - Configuration
For any clusters that cannot upgrade immediately to 3.1.0, rotate the ZooKeeper credential stored in `storm.zookeeper.topology.auth.payload` for existing topologies (and review any retained logs/support bundles for leaked values).
Apache Storm storm.zookeeper.topology.auth.payload = rotate - Configuration
Restrict read-only topology permissions to trusted principals only, since Storm previously served the topology configuration (including `storm.zookeeper.topology.auth.payload`) verbatim to any caller with read-only topology permissions.
Apache Storm Read-only topology permissions = restrict - Operational
Review retained logs and any support bundles collected from the cluster for the value of `storm.zookeeper.topology.auth.payload`, since it may have been disclosed to read-only users and/or written to logs in affected versions. Rotate the credential if it appears in those artifacts.
Event History
Frequently Asked Questions
Who can obtain the credential through the service interface?
Any caller with read-only permission for a topology can receive the topology's ZooKeeper authentication payload when ZooKeeper authentication is configured. The caller does not need topology write permission.
What could someone do with a disclosed topology credential?
The credential can be used to forge or remove worker heartbeat, backpressure, and error state for the affected topology. It is not a write credential for assignments.
Could the credential be exposed outside the Nimbus configuration response?
Yes. The submission client logged generated payloads at INFO level, and SASL handlers logged them at DEBUG level. As a result, the credential may also exist in log aggregation systems or support bundles collected from the cluster.
What should be done if an immediate upgrade is not possible?
Rotate storm.zookeeper.topology.auth.payload for existing topologies and review retained logs or other collected artifacts that may contain the payload. Upgrading to 3.1.0 removes the payload from configurations served to read-only callers and stops writing it to logs.