CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
Description
getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/{id} and of the corresponding metrics endpoint.
Where the cluster is configured with them, the merged map includes storm.zookeeper.auth.payload, which Storm's own documentation directs operators to keep in storm-cluster-auth.yaml under permissions that deny access from workers, together with the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration, and any plugin key whose name denotes a secret.
getTopologyPageInfo is a topology read-only operation. Under SimpleACLAuthorizer a principal listed in topology.readonly.users or topology.readonly.groups could therefore read daemon credentials that the dedicated cluster configuration API, getNimbusConf, redacts and that is gated on nimbus.users instead. The sibling operations that exist to serve configuration were masked; the topology page, which merges in strictly more daemon state, was not.
Mitigation
Upgrade to 3.1.0, where credential-bearing values are masked before any configuration is served over the Nimbus API.
Users who cannot upgrade immediately should remove any principal that is not trusted with cluster credentials from topology.readonly.users, topology.readonly.groups, topology.users and topology.groups, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through the topology page.
Credit Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Storm Nimbus / Apache Storm UIto a version that resolves this vulnerability.Fixed in 3.1.0 - Configuration
Under SimpleACLAuthorizer, remove any principal that is not trusted with cluster credentials from topology.readonly.users, topology.readonly.groups, topology.users, and topology.groups so they cannot access topology read operations that expose merged daemon configuration.
Apache Storm Nimbus SimpleACLAuthorizer principal access lists (topology.readonly.users, topology.readonly.groups, topology.users, topology.groups) = Remove any non-trusted principal(s) that are not trusted with cluster credentials - Operational
Rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through the topology page.
Event History
Frequently Asked Questions
Who can access the exposed configuration?
Under SimpleACLAuthorizer, a principal listed in topology.readonly.users or topology.readonly.groups can perform the affected topology read-only operation. This access is less restrictive than the nimbus.users gate used by the dedicated cluster configuration API.
What does an attacker need to exploit this issue?
The attacker needs access as a topology read-only principal and must be able to request topology information through the topology page or the corresponding Storm UI or metrics API endpoint. The issue affects the topology_conf value returned in TopologyPageInfo and copied into GET /api/v1/topology/{id}.
What sensitive values may be disclosed?
The merged configuration can include storm.zookeeper.auth.payload, keystore and truststore passwords for Thrift, Netty, and ZooKeeper TLS configuration, and plugin keys whose names denote a secret. Exposure depends on whether those values are configured in the cluster.
How can operators determine whether they are affected?
Review whether SimpleACLAuthorizer is in use and whether topology.readonly.users or topology.readonly.groups contains principals that should not receive daemon configuration. Check the configuration field returned by GET /api/v1/topology/{id} and the corresponding metrics endpoint for unredacted merged daemon settings.