Description

Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered. An operator who restricted cluster access by group alone, leaving `nimbus.users` unset, therefore received no restriction at all: every authenticated principal was permitted every user-level operation, including `submitTopology`, `beginFileUpload` and `getNimbusConf`. `docs/SECURITY.md` presents `nimbus.groups` as a supported way to lock down a cluster, so a deployment following the documentation could believe it was restricted while it was not. The failure is silent; nothing in the logs or the configuration indicates that the group list is being ignored. Both lists left empty continues to mean that no restriction is configured, which is the shipped default and is unchanged. Mitigation Upgrade to 3.1.0, where `nimbus.groups` is evaluated whether or not `nimbus.users` is set. Users who cannot upgrade immediately should additionally populate `nimbus.users` with the intended principals, since a non-empty user list causes the group list to be evaluated on affected versions. Operators should review Nimbus access logs for operations by principals outside the intended groups. Note that after upgrading, a cluster configured with `nimbus.groups` alone becomes restrictive for the first time. This includes `NimbusClient`, which calls `getLeader` on every connection, so clients outside the configured groups will begin to be refused. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T15:17:10.053Z",
  "pubdate": "2026-09-14T15:17:10.053Z",
  "executiveSummary": "This vulnerability is an authorization bypass flaw identified in the SimpleACLAuthorizer component of Apache Storm.\nThe issue stems from improper logic in the access control evaluation process, where the Nimbus service fails to validate user group memberships if the user-level command set (nimbus.users) is left unconfigured.\nThis creates a critical security gap where operators intending to restrict cluster access via nimbus.groups are left unprotected, as the system defaults to an permissive state rather than applying the intended group-based constraints.\nAn authenticated principal, even if not part of the intended administrative groups, gains unauthorized access to sensitive user-level operations including topology submission, file uploads, and configuration retrieval.\nThe flaw poses a significant risk to cluster integrity and confidentiality. Because the failure is silent, administrators are often unaware that their access control policy is ineffective.\nExploitation is trivial once the attacker has established authentication to the Nimbus service, as no further bypass techniques are required to trigger the authorization failure.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the SimpleACLAuthorizer in the Nimbus service. The authentication logic prematurely short-circuits the authorization check when the 'nimbus.users' configuration key is empty.\nIn the vulnerable versions, the authorizer evaluates 'nimbus.users' first; if the list is empty, the logic exits early, effectively bypassing the subsequent evaluation of 'nimbus.groups'. This implementation flaw renders the group-based access control list (ACL) entirely inert whenever the user-level list is undefined.\nThe attack flow proceeds as follows: 1) An operator configures the cluster with 'nimbus.groups' to enforce access control but leaves 'nimbus.users' unset in the configuration file. 2) An authenticated principal attempts an operation restricted by the intended group policy (e.g., 'submitTopology'). 3) The SimpleACLAuthorizer service receives the request and checks 'nimbus.users'. 4) Finding the user list empty, the service returns early and grants the request without inspecting the 'nimbus.groups' list, successfully bypassing the intended authorization constraint.\nThe impact of this bypass is significant, as it permits unauthorized principals to perform administrative or privileged operations that were intended to be restricted. Attackers can leverage this to deploy malicious topologies, exfiltrate sensitive configuration data via 'getNimbusConf', or manipulate the file system through 'beginFileUpload'.\nAffected versions include any version of Apache Storm prior to 3.1.0 that utilizes the SimpleACLAuthorizer. This issue is particularly dangerous because it contradicts documentation provided in 'docs/SECURITY.md', which explicitly lists 'nimbus.groups' as a supported method for cluster lockdown. The failure is silent, producing no audit trail or log entry indicating that the group-based policy is being ignored or bypassed.\nThe vulnerability requires that the attacker has authenticated to the Nimbus service. Once authenticated, the attacker effectively escalates their privileges to those of a authorized user, irrespective of their actual group membership in the organization’s identity provider or internal configuration.\nPost-exploitation impact involves full control over topology lifecycle management and the potential for lateral movement or data exfiltration from the Nimbus configuration."
}