Description

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/{id} and of the corresponding metrics endpoint. Where the cluster is configured with them, the merged map includes storm.zookeeper.auth.payload, which Storm's own documentation directs operators to keep in storm-cluster-auth.yaml under permissions that deny access from workers, together with the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration, and any plugin key whose name denotes a secret. getTopologyPageInfo is a topology read-only operation. Under SimpleACLAuthorizer a principal listed in topology.readonly.users or topology.readonly.groups could therefore read daemon credentials that the dedicated cluster configuration API, getNimbusConf, redacts and that is gated on nimbus.users instead. The sibling operations that exist to serve configuration were masked; the topology page, which merges in strictly more daemon state, was not. Mitigation Upgrade to 3.1.0, where credential-bearing values are masked before any configuration is served over the Nimbus API. Users who cannot upgrade immediately should remove any principal that is not trusted with cluster credentials from topology.readonly.users, topology.readonly.groups, topology.users and topology.groups, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through the topology page. Credit Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T14:17:13.130Z",
  "pubdate": "2026-09-14T14:17:13.130Z",
  "executiveSummary": "This vulnerability involves an information disclosure flaw in Apache Storm, where sensitive configuration data is exposed via the Nimbus API.\nThe issue stems from the getTopologyPageInfo function failing to redact sensitive daemon-level configurations—including Zookeeper authentication payloads and TLS keystore/truststore passwords—when merging them into topology metadata.\nThis impacts all deployments where users have read-only access to topologies, as these principals can retrieve secrets that should be strictly gated by administrative ACLs.\nThe vulnerability allows unauthorized users with topology-level read access to gain visibility into critical cluster secrets, potentially leading to unauthorized access to Zookeeper, TLS-secured services, or other internal system components.\nExploitation does not require administrative privileges, merely the ability to view a topology, making it a high-risk security oversight.\nUsers are strongly advised to upgrade to version 3.1.0 or enforce strict ACL management to limit exposure to these credentials.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of configuration objects within the getTopologyPageInfo function in the Apache Storm Nimbus daemon. When this function is invoked, it programmatically merges global daemon configuration parameters with topology-specific configuration settings. In affected versions, this resulting configuration map includes highly sensitive keys such as storm.zookeeper.auth.payload and various TLS keystore/truststore passwords, which are designated for restricted administrative access.\nThe vulnerability is exposed through the Storm UI, which consumes the data returned by getTopologyPageInfo and relays it verbatim to the GET /api/v1/topology/{id} endpoint and its associated metrics endpoints. Although the Storm API contains separate, gated mechanisms (specifically getNimbusConf) intended for administrative configuration retrieval, the topology-specific endpoint erroneously bypasses these redaction requirements.\nThe exploitation flow is straightforward: an attacker authenticates as a principal authorized within the cluster (e.g., a user listed in topology.readonly.users or topology.readonly.groups). Once authenticated, the attacker sends a legitimate API request to the /api/v1/topology/{id} endpoint. The Nimbus daemon responds by returning a JSON object containing the full, unredacted merged configuration. Because the authorization check for this endpoint is scoped to topology-level read access rather than nimbus.users administrative access, the attacker successfully retrieves sensitive environment secrets without further interaction.\nThis flaw effectively elevates the privileges of low-privileged users to include the ability to extract infrastructure-wide secrets. By obtaining these credentials, an attacker can move laterally to other services protected by these credentials, such as Zookeeper or internal RPC services secured by Thrift or Netty TLS. The impact is significant as these credentials provide the foundation for cluster security, and their compromise undermines the entire security posture of the Storm deployment.\nThe vulnerability persists across all deployments prior to version 3.1.0 that rely on the affected logic for topology information retrieval. The exposure is network-reachable to any actor capable of hitting the Storm UI or API endpoints, and the attack requires no specialized exploit code, only standard HTTP client interaction."
}