Description

Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes `storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration. The project masks passwords elsewhere before display, so the omission here is inconsistent rather than intended. The UI endpoint `/api/v1/cluster/configuration` compounded this. It carried no `@AuthNimbusOp` annotation, and the authorization filter treated a missing annotation as "no gate required" and returned immediately, so the endpoint applied no per-user check at all and proxied the request under the UI daemon's own principal. Any user able to pass `ui.filter` therefore received the full configuration, including principals that Nimbus itself would have refused.  Mitigation Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and where every UI API endpoint must declare its authorization explicitly. Users who cannot upgrade immediately should place the UI behind an authenticating reverse proxy that restricts `/api/v1/cluster/configuration`, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through it. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T15:17:10.323Z",
  "pubdate": "2026-09-14T15:17:10.323Z",
  "executiveSummary": "This vulnerability involves an improper authorization check and insufficient credential masking within the Apache Storm configuration API.\nAffected systems running Apache Storm versions prior to 3.1.0 are susceptible to the unauthorized retrieval of sensitive daemon configuration data.\nThe vulnerability manifests in two ways: the `getNimbusConf` function fails to redact sensitive fields, and the `/api/v1/cluster/configuration` UI endpoint lacks mandatory authorization annotations.\nAn authenticated user with access to the UI can exploit this to obtain highly sensitive information, including the `storm.zookeeper.auth.payload`, as well as keystore and truststore passwords for Thrift, Netty, and ZooKeeper TLS configurations.\nThis represents a high-risk security flaw as it facilitates the exposure of administrative credentials, potentially leading to unauthorized cluster control or interception of encrypted traffic.\nThe exploitation requires the attacker to pass the `ui.filter`, after which the system erroneously serves the full configuration without further per-user validation.",
  "technicalDetails": "The vulnerability is primarily rooted in an authorization bypass and an inconsistency in data sanitization routines within the Apache Storm codebase.\nThe `getNimbusConf` function, responsible for serving daemon configuration, fails to apply the standard masking logic used in other areas of the application. Consequently, sensitive keys such as 'storm.zookeeper.auth.payload' and cryptographic passwords for TLS-secured communication channels are returned in plaintext to the requester.\nThe security posture of the `/api/v1/cluster/configuration` endpoint is further compromised by the absence of the `@AuthNimbusOp` annotation. The platform's authorization filter interprets the missing annotation as a 'no-gate' condition, effectively bypassing all per-user access control checks.\nWhen an authenticated user requests this endpoint, the UI daemon proxies the request under its own principal. Because the check is bypassed, the endpoint serves the entire configuration block without verifying whether the requesting user possesses the necessary administrative privileges.\nAn attacker can exploit this by simply navigating to the exposed API endpoint after authenticating through the standard `ui.filter`. Once access is granted, the application leaks the complete configuration, including authentication tokens and keystore credentials.\nThis data exposure is catastrophic as it provides attackers with the necessary artifacts to impersonate services or decrypt internal cluster traffic. By obtaining ZooKeeper authentication payloads and keystore passwords, an attacker can move laterally, escalate privileges within the Storm cluster, or manipulate cluster state directly via ZooKeeper.\nThe vulnerability affects versions prior to 3.1.0 and is considered critical due to the ease of exploitation and the depth of the sensitive information disclosed."
}